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FOREWORD 


The  use  of  computers  to  automate  the  information  handling  and  record-keeping 
activities  of  Government  and  private  organisations  has  brought  the  benefits  of  speed 
and  efficiency  to  these  operations.     But  it  has  also  brought  concerns  for  privacy 
stemming  from  the-  desire  of  individuals  to  control  the  collection  of  information 
about  themselves  and  to  exercise  some  measure  of  control  over  the  use  of  that 
information . 

Consideration  of  this  basic  issue  —  how  to  utilize  the  benefits  of  technology 
while  preserving  individual  rights  --  has  led  to  public  policy  regulating  the  use  of 
personal  information  in  credit  reporting  and  Federal  record-keeping. 

Medical  record-keeping  is  an  area  of  special  concern  and  broad  impact  for  the 
development  of  sound  public  policy  respecting  privacy  rights.     Computer  technology 
applied  to  medical  records  offers  promising  benefits  of  increased  efficiency  and 
improved  health  care.     Advances  in  computer  and  communications  technology  could 
enable  doctors  in  remote  areas  to  have  ready  access  to  relevant  information.  The 
analytic  power  of  the  computer  could  be  used  in  medical  diagnosis.     Medical  research 
could  be  advanced  through  computer  analysis  of  existing  medical  records. 

However,  this  is  a  sensitive  area  where  privacy  concerns  are  strong.  The 
National  Bureau  of  Standards  has  sponsored  this  study  of  the  privacy  issues  in 
medical  record-keeping  to  advance  understanding  of  the  attendant  privacy  problems  and 
their  possible  solution.     This  report,  Computers ,   Health  Records  and  Citizen  Rights , 
is  the  result  of  a  two-year  research  effort  directed  by  Dr.  Alan  F.  Westin,  Professor 
of  Public  Law  and  Government,   Columbia  University.     Dr.  Westin  is  the  co-author  of 
Databanks  in  a  Free  Society ,  the  landmark  study  of  computers  and  privacy. 

We  offer  Dr.  Westin 's  recommendations  to  the  health  care  and  medical  community 
for  their  consideration  with  the  hope  that  these  recommendations  will  help  them 
develop  policies  that  assure  the  protection  of  individual  privacy  rights.     As  the 
first  thorough  investigation  of  privacy  issues  in  one  sector  of  American  society  with 
sector-specific  recommendations,   it  should  provide  helpful  insights  and  a  model 
methodology  for  studying  privacy  concerns  in  other  areas.     Towards  this  end,  NBS  and 
the  Privacy  Protection  Study  Commission  are  jointly  sponsoring  a  follow-up  study  by 
Dr.  Westin  on  personnel  record-keeping  practices. 

Dr.  Westin 's  study  deserves  wide  review  and  careful  consideration. 

Ruth  M.   Davis,  Ph.D. 
Director 

Institute  for  Computer 
Sciences  and  Technology 

iii 


PREFACE 


This  report  has  its  origins  in  a  Workshop  on  Privacy  that  met  in  Gaithersburg , 
Meiryland,  on  February  8-9,  1973.     Sponsored  by  the  National  Bureau  of  Stajadards  and 
the  Association  for  Computing  Machinery,  the  group  included  experts  from  the  computer 
community,  law,  the  social  sciences,  public  interest  and  civil  liberties  groups, 
federal  executive  agencies,  and  state  legislatures. 

Looking  over  the  then-current  state  of  the  computers-and-privacy  issue,  the  Work- 
shop saw  the  United  States  entering  a  new  phase  of  this  problem.     In  the  mid-1960s 
there  had  been  early  alarms  about  the  potential  impact  of  computer  technology  on 
citizen  rights.     This  was  followed  between  I968  and  1972  by  a  period  of  empirical 
studies  and  legislative  inquiries,  probing  just  what  the  effect  of  computer  use  by 
organizations  had  been  so  far.     Now,  the  Workshop  concluded,  having  perceived  the 
threats  and  mapped  the  issues,  the  nation  was  moving  into  a  period  of  policy 
definition  and  regulatory  action. 

This  new  period  would  not  be  a  short  one.     The  Workshop  was  agreed  that  no  legal 
or  technological  "fixes"  could  be  applied  quickly  and  comprehensively  to  automated 
personal  data  systems.     The  basic  issues  involved  in  organizational  record  keeping 
about  people  involved  fundamental  debates  for  American  society  over  changing  social 
values,  new  definitions  of  civil  liberties,  controversial  government  programs  and 
business  services,  and  shifting  conceptions  of  proper  and  improper  organizational 
authority.     In  addition,  computer  and  communication  technologies  were  highly  dynamic; 
their  continually  changing  capacities,  problems,  and  opportunities  would  require  very 
sensitive  and  flexible  policy  mechanisms,  continually  reviewed. 

The  Workshop  saw  the  middle  1970 's  as  a  critical  period  in  the  development  of 
sound  public  policies.     The  empirical  reports  and  hearings  of  the  1969-1972  phase  had 
alerted  the  media,  the  public,  and  national  policy-makers  to  the  need  for  action,  and 
a  wide  variety  of  standards-setting  proposals  had  been  presented  to  legislatures, 
regulatory  agencies,  and  organizational  managers.     Because  many  of  these  would 
involve  far-reaching  and  expensive  changes  in  the  operations  of  major  business  and 
government  functions  in  American  society,  they  required  a  careful  assessments  were 
they  responsive  to  the  real  problems  of  citizen  rights  in  a  given  situation?  what 
was  their  potential  impact  on  the  informational  needs  of  organizations  and  society? 
did  they  have  the  right  blend  of  guiding  principles,  specific  rules,  realistic 
procedures,  and  enforceable  remedies? 

Most  important  of  all,  the  Workshop  was  concerned  that  the  public's  clear  desire 
for  new  privacy  protections  be  chsuineled  into  law  in  time  to  catch  the  wave  of  large- 
scale  systems  building  and  adoption  of  fourth-generation  computer-system  technology 
that  was  expected  to  unfold  in  the  middle  and  late  1970 's.     The  participants  at  the 
Workshop  were  agreed  that  many  of  the  proposed  protections  for  individual  rights 
would  be  "affordable"  in  dollar  costs  if  these  were  spelled  out  as  system  requirements 
as  the  new  systems  were  being  designed,  or  as  existing  systems  were  undergoing  major 
expansion.     What  would  be  painful  or  even  unbearable,  in  terms  of  cost,  would  be  to 
wait  so  long  to  formulate  broadly-acceptable  standards  that  information  systems,  as 
Dr.  Ruth  Davis  put  it,  would  have  to  be  "retro-fitted"  to  conform  to  the  new  rules. 
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The  Workshop  speculated  that  new  legislative  policies  in  the  middle  Seventies 
would  be  likely  to  follow  two  main  lines.     One  would  be  the  enactment  of  broad 
"fair  information  practices"  laws  directed  at  the  record-keeping  of  all  agencies  at  a 
particular  level  of  government,  ajid  covering  both  manual  and  automated  data  systems. 
(This  approach,  based  on  recommendations  of  the  HEW  Advisory  Committee  on  Automated 
Personal  Data  Systems*,  was  soon  well  under  way,  sind  has  already  resulted  in  the 
enactment  of  the  Federal  Privacy  Act  of  197^  ajid  similar  laws  in  five  states.)  The 
second  line  of  legislation  would  involve  the  passage  of  laws  to  deal  with  particular 
fields  of  record  keeping,  where  detailed  codes  would  be  enacted  to  define  citizen 
rights,  work  out  balances  among  conflicting  social  values,  sind  set  specific  mechanisms 
of  supervision  and  enforcement. 

To  help  both  policy  makers  and  systems  developers  evolve  a  set  of  basic  standards 
during  this  early  regulatory  phase,  the  Workshop  felt  it  would  be  valuable  to  conduct 
a  series  of  interdisciplinary  studies,  following  the  approach  of  the  National  Academy 
of  Sciences'  Project  on  Computer  Databanks.**  That  project  had  produced,  for  each 
field  of  organizational  activity:  (1)  a  description  of  the  pre-computer  baseline  of 
record-keeping  practices  and  citizen  rights  rules;  (2)  an  empirical  study  of  how 
computers  were  being  used  there  and  the  effects  this  was  having  on  the  operations  of 
personal  record  keeping;  and  (3)  an  analysis  of  policy  alternatives  available  to 
insure  that  society's  current  expectations  about  citizen  rights  in  that  field  were 
carried  out,  in  both  automated  and  manual  data  systems. 

Looking  over  the  main  fields  of  organizational  record-keeping  about  people,  the 
Workshop  identified  a  group  of  these  that  seemed  to  merit  priority  attention,  based 
on  factors  such  as  the  number  of  persons  affected  by  these  activities,  the  extensive- 
ness  of  computer  use,  and  the  readiness  of  law  and  public  opinion  to  taJce  up 
regulatory  alternatives.     The  fields  selected  were:  banking  and  finance;  credit 
bureaus  and  commercial  reporting  agencies;  education;  personnel  practices;  social 
and  evaluative  research;  law  enforcement  and  criminal  justice;  welfare;  and  health 
care . 

The  Workshop  decided  that  the  best  course  was  to  select  one  field  and  do  it  as  a 
model  study.     Once  this  was  conducted  and  published,  its  technique  could  be  evaluated 
and,  where  it  proved  relevant,  used  by  other  researchers,  organizational  managers, 
and  government  study  commissions.    For  reasons  that  will  be  noted  in  the  Introduction, 
health  care  was  selected  to  be  the  first  field  treated, and  the  Institute  for  Computer 
Sciences  and  Technology  of  the  National  Bureau  of  Standards  was  able  to  provide  the 
funds  to  carry  out  the  research. 

This  pilot  project  having  been  completed,  the  Institute  is  now  sponsoring  a 
second  study,  to  be  conducted  during  I976-77.     It  deals  with  the  personnel  data 
systems  of  government  agencies,  business,  and  non-profit  organizations,  and  is  being 
funded  jointly  by  the  National  Bureau  of  Standards  and  the  federal  Privacy  Protection 
Study  Commission. 


*Records,  Computers,  and  the  Rip:hts  of  Citizens.  Report  of  the  Secretary's  Advisory 
Committee  on  Automated  Personal  Data  Systems.  U.S.  Department  of  Health,  Education, 
and  Welfare,  July,  1973,  DHEW  Publication  No.   (OS)  73-74. 

**Alan  F.  Westin  and  Michael  A.  Baker,  Databanks  in  a  Free  Society  (New  York- 
Quadrangle,  1972.)  ~ 
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While  many  persons  and  orgainizations  aided  in  the  health  care  study  (and  are 
gratefully  mentioned  in  the  Acknowledgments  section  of  the  Appendix)  two  persons 
deserve  to  be  noted  here  as  the  sustaining  godparents  of  this  worki     Dr.  Ruth  M.Davis, 
Director  of  the  Institute  for  Computer  Sciences  and  Technology  of  the  National  Bureau 
of  Standards,  and  Mr.  Walter  M.  Carlson,  first  in  his  capacity  as  President  of  the 
Association  for  Computing  Machinery,  when  the  Workshop  on  Privacy  was  created,  and 
since  then  as  an  advisor  to  N.B.S.     Their  patronage  was  in  the  best  of  the 
Renaissance  tradition. 

Alan  F.  Westin, 
March  31 ,  1976 
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A  NOTE  TO  READERS 


Though  the  Project  on  Medical  Records  and  Citizen 
Rights  is  completed,  the  Director  would  welcome  comments 
from  readers  about  the  facts  presented,  issues  raised, 
and  recommendations  presented  in  this  Report.  Additional 
examples  of  intentional  or  unintentional  violations  of 
individual  rights  in  medical  records  and  health  data  would 
be  particularly  welcome,  as  well  as  new  policy  problems 
that  may  have  arisen  too  recently  to  have  been  included 
in  this  study.     Such  material  will  be  used  in  an  updating 
of  this  Report  to  be  published  later,  in  a  general  forum 
available  to  all  interested  parties. 

Please  send  such  communications  to: 

Professor  Alan  F.  Westin 
Department  of  Political  Science 
729  International  Affairs  Building 
Columbia  University 
New  York,  N.Y.  1002? 
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EXECUTIVE  SUMMARY 


Background 

The  concept  of  this  model  study  originated  in  a  Workshop  on  Privacy  held  in  1973 
under  the  auspices  of  the  Association  for  Computing  Machinery  and  the  Institute  for 
Computer  Sciences  and  Technology,  National  Bureau  of  Standards.     The  workshop  believed 
it  would  be  valuable  to  select  one  important  area  of  record-keeping  about  people  that 
was  undergoing  significant  computerization  and  conduct  a  study  that  would  identify  the 
standards  to  be  installed  if  society  is  to  realize  benefits  from  information 
technology  without  jeopardizing  fundamental  citizen  rights. 

Health  care  was  chosen  for  the  pilot  study  for  several  reasons.     These  include 
the  universal  impact  of  health-care  records  on  the  population;  the  fundamental  recon- 
sideration of  goals  and  organization  in  American  health  care  now  taking  place;  the 
imminence  of  some  kind  of  national  health  insurance  plan;  the  increasing  use  of  computers 
in  health  care;  and  current  debates  over  the  right  of  individuals  to  control  the  uses 
made  of  their  personal  health  data.     Funding  for  the  study  was  provided  by  NBS. 

Objectives  and  Methodology 

The  study  had  three  objectives:  to  describe  the  pre-computer  baseline  of  record- 
keeping practices  and  citizen-rights  rules  in  health  organizations;  to  conduct  an 
empirical  study  of  how  computers  were  being  used  there,  and  the  effects  this  was  having 
on  the  operations  of  personal  record-keeping;  and  to  identify  the  principles  and  policy 
alternatives  that  would  assure  observance  of  citizen  rights  in  emerging  data  systems, 
especially  the  automated  ones. 

Research  was  conducted  by  a  small,  interdisciplinary  team  under  the  direction  of 
Alan  F.  Westin,  Professor  of  Public  Law  and  Government,  Columbia  University,  beginning 
in  the  summer  of  1974  and  finishing  in  April,  1976.     Examination  of  published  literature 
from  medicine  and  health,  law,  computing,  and  social  science  was  augmented  by  interviews 
with  major  computer  manufacturers,  systems  developers,  and  civil  liberties,  public- 
interest,  consumer,  and  minority-rights  groups.     On-site  visits  were  made  to  six  rep- 
resentative health-care  organizations  using  computers  to  handle  personal  records,  with 
detailed  profiles  written  of  each  organization.     Correspondence  and  follow-up  contacts 
were  conducted  with  70  organizations  in  the  health  care  field.     A  draft  report  of  the 
project's  findings  and  recommendations  was  reviewed  at  a  conference  of  experts  in 
September  of  1975,  and  then  by  approximately  50  outside  reviewers.     Following  this,  the 
Director  and  a  professional  writer  re-wrote  the  report  to  reflect  suggestions  from  the 
reviews  and  additional  research.     The  final  report's  presentation  and  recommendations 
are  solely  the  responsibility  of  the  Director,  and  have  not  been  subject  to  any  clear- 
ance process  by  the  project  staff  or  the  sponsor. 

Part  I ;  The  Record-Keeping  Baseline 

As  a  baseline  for  studying  the  impact  of  computer  use  in  health  care,  the  report 
describes  three  different  zones  in  which  individual  health  data  is  used,  each  with 
different  social  norms  and  legal  rules  as  to  rights  of  privacy,  confidentiality,  and 
individual-access . 

A.  In  Zone  1 ,  primary  health  care ,  the  report  describes  how  medical  records  are 
used  when  a  patient  seeks  help  from  a  health  professional,  whether  in  a  physician's 
office,  a  clinic  or  hospital,  or  in  the  health  unit  of  an  institution  (colleges. 
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corporations,  the  military,  etc.)-     Though  the  importance  of  promoting  full  disclosure 
by  patients  to  doctors  has  produced  a  long-standing  ethical  duty  of  confidentiality, 
and  legal  privilege  against  courtroom  disclosure  in  most  American  states,  the  report 
shows  how  the  growth  of  third-party  payment  for  medical  care,  utilization  reviews, 
and  the  growing  uses  of  health  data  for  social  decisions  have  seriously  weaikened  the 
observance  of  strict  confidentiality. 

The  study  found  that  the  requirement  of  "informed  consent"  by  patients  to 
release  of  their  primary  care  data  is  rarely  well  observed  today.     In  part,  this  is 
because  consent  is  often  coerced  by  the  threat  of  losing  services  or  is  assumed  to 
be  implied.     Informed  consent  is  also  weakened  because  patients  do  not  have  a 
general  right  to  see  what  is  in  their  records,  either  before  the  data  is  released 
to  third  parties  or  as  a  matter  of  patient  interest  during  regular  care.  Such 
problems  of  consent  and  access  are  being  exacerbated   in  institutional  health  care, 
where  physicians  are  employees  of  the  institution  and  have  mixed  loyalties  in 
handling  patient  information. 

Overall,  the  main  finding  of  this  section  is  that  identified  patient  information 
from  medical  records  now  flows  regularly  out  of  the  primary  care  setting  in  ways  that 
allow  patients  few  controls  over  these  disclosures. 

B.  Zone  2  covers  use  of  medical  data  for  payment  of  services  and  quality-of- 
care  reviews.    For  the  190  million  Americans  whose  bills  are  paid,  in  part,  by 
private  insurance  coverage  or  government  medical  programs ,  the  legitimate  need  for 
payers  to  determine  eligibility,  assess  claims,  and  detect  provider  fraud  has 
created  a  system  in  which  reports  of  sensitive  diagnoses  and  conditions  are  forwarded 
from  primary  care  records.     The  study  found  considerable  disagreement  between 
medical  professionals  and  the  payers  as  to  how  much  personal  data  from  medical 
records  really  needs  to  be  disclosed  for  the  payment- review  function,  an  issue  of 
privacy  that    is   particularly  sensitive  where  review  of  psychiatric  conditions  is 
involved.     The  study  also  found  that  existing  practices  have  not  prevented  leakage 

of  personal  medical  data  to  persons  whom  the  individual  did  not  want  (or  consent)  to 
have  access  to  such  facts,  such  as  employers  or  fellow-employees  in  group  health  plans 
or  government-agency  employers.     Questions  have  also  been  raised  about  how  long 
personal  data  need  to  be  retained  by  payers,  and  whether  subscribers  and  aid 
recipients  should  have  the  right  to  examine  their  records. 

As  to  utilization  reviews  and  quality-care  assurance,  the  study  found  that  the 
use  of  these  processes  has  not  raised  serious  citizen  rights  issues  up  until  now. 
However,  the  creation  of  the  new  PSRO  review  system  for  Medicare  and  Medicaid  has 
generated  considerable  controversy  over  how  patient  and  physician  privacy  will  be 
handled . 

C.  In  Zone  3,  social  uses  of  health  data,  the  report  details  how  American 
society  has  come  to  require  the  disclosure  of  personal  health  data  to  serve  a  wide 
range  of  other  important  interests,  from  employment,  life  insurance,  welfare,  and 
rehabilitation  to  law  enforcement,  social  research,  licensing,  and  prevention  of 
child  abuse.    How  to  adjust  the  balance  between  claims  of  medical  confidentiality 
and  legitimate  social  programs  clearly  requires  careful  assessment  area  by  area. 
However,  the  report  finds  rising  criticism  of  the  use  of  health  data  in  many  of 


xi  i 


these  areas  to  make  what  are  challenged  as  stigmatizing  and  discriminatory  judgments 
about  people.     This  involves  disabilities  against  persons  who  have  had  psychiatric 
treatment,  or  various  kinds  of  non-disabling  physical  ailments,  or  whose  practice  of 
homosexuality  is  supposed  to  make  them  greater  health  risks  than  heterosexuals,  or 
women  who  have  had  abortions,  or  persons  who  want  to  keep  confidential  the  fact  that 
they  are  undergoing  drug  or  alcohol  rehabilitation.     In  the  post-Watergate  mood,  the 
protests  have  been  particularly  sharp  when  it  is  government  agencies  that  insist 
upon  recording  such  sensitive  health  data  and  using  it  to  control  the  individual's 
rights  and  opportunities. 

D.  In  all  three  zones,  the  report  concludes  that  traditional  laws  and  organiza- 
tional policies  have  not  kept  pace  with  the  new  flows  and  uses  of  health  information 
throughout  our  society,  and  that  standards  to  resolve  the  growing  policy  debates 
are  lacking  in  many  sectors  of  the   national  health  care  system.     This  leaves  compute 
systems  developers  in  health  care  without    clear  policies  to  guide  the  automation 
of  files  and  assemblage  of  data  systems. 

Part  II:  Patterns  of  Computerization  in  Health  Care,  and  Their  General  Citizen 
Rights  Implications 

A.  The  study  examined  current  patterns  of  computer  use  in  each  of  the  three 
zones.     While  automation  in  Zone  1,  primary  care,  has  been  slight  in  the  physician's 
office,  the  crush  of  paperwork  in  large  clinics  and  hospitals  for  billing  and 
accounting,  third-party  payment,  reporting  duties,  lab  tests,  and  similar  areas  has 
produced  extensive  computer  applications.     The  development  of  integrated-f ile , 
databank-oriented  hospital  information  systems,  though  much  discussed  in  the 
technical  literature  and  the  general  press,  remains  largely  at  the  pilot  stage 
where  it  is  being  attempted.     Overall,  the  main  effects  on  citizen  rights  of 
computer  applications  to  patient  records  in  primary  care  has  been  to  increase  the 
systematic  collection,  recording,  and  centralization  of  patient  data,  both  social 
and  medical;  this  tends  to  sharpen  questions  of  just  what  data  ought  to  be  recorded, 
how  long  it  should  be  kept,  what  release  procedures  are  to  be  used,  and  whether 
patients  will  be  able  to  inspect  what  is  in  their  records. 

B.  In  Zone  2,  service  payment,  computer  use  has  been  widespread  throughout  the 
health  insurance  industry,  with  increasing  amounts  of  patient  data  being  collected 
and  stored  in  their  files.    While  no  special  problems  of  leakage  have  appeared  as 

a  result  of  computer  use  per  se,  unclear  policy  definition  as  to  what  identified 
data  should  be  collected  for  payment  reviews  and  who  else  should  get  such  data  are 
central  issues  here. 

C.  In  Zone  3,  the  report  did  not  try  to  describe  how  computers  are  being  used 
in  the  dozen  or  so  major  areas  of  social  activity  that  use  health  data  to  support 
their  functions.     However,  one  Zone  3  area  whose  computer  use  was  examined  was 
automation  by  government  health-administration  agencies,  which  have  increasingly 
been  creating  controversial  databaxiks  of  identified  patient  data  for  planning, 
evaluation,  and  research  purposes. 
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D.  Overall,  the  survey  of  computerization  in  health  care  found  that  automation 
has  not  been  as  extensive  as  in  fields  such  as  banking,  law  enforcement,  or  taxation, 
though  it  is  growing  steadily  in  use  and  sophistication.     Some  observers  feel  that 
a  sharp  take-off  in  health  computing  is  about  to  occur,  as  a  result  of  rising  costs 
requiring  closer  record-keeping  controls  and  the  likely  prospect  of  national  health 
insurance.    However,  expansion  of  computer  use  for  hospital  information  systems  is 
not  seen  as  imminent,  owing  to  the  absence  of  conceptual  models  of  how  information 
uses  in  the  hospital  could  be  reorganized  in  ways  that  would  be  both  cost-effective 
and  acceptable  to  health  professionals  and  the  public. 

Part  III:  Profiles  of  Computerizing  Organizations 

To  examine  how  organizational  policies  and  computerization  efforts  are  affecting 
citizen  rights,  the  study  presents  detailed  profiles  of  six  organizations  involved 
in  automating  personal  health  records. 

A.  Los  Angeles  County  Medical  Center  is  a  large  county  facility  primarily 
serving  the  urban  poor  and  minority  groups  of  East  Los  Angeles.     It  is  an  average 
or  "mainstream"  computer  user,  with  a  project  to  automate  medical  records  in  a 
databank  to  improve  patient  care.     The  profile  shows  that  the  factors  which  shape 
basic  citizen  rights  policy  are  the  pressure  on  the  Center  to  recover  costs,  leading 
to  an  emphasis  on  collecting  extensive  personal  data;  the  Center's  cooperative 
relations  with  local  government  and  police  officials  seeking  patient  data;  and  a 
"ghetto-crisis"  medicine  that  has  no  place  for  such  "luxuries"  as  giving  patients 
access  to  records  or  obtaining  truly  informed  consent  before  releasing  patient 
information.     Computer  use  at  the  Center  incorporates  these  basic  problems  and 
reactive  policies.     The  report  concludes  that  it  would  take  a  combination  of  new 
patient-rights  legislation  and  reorientation  of  staff  resources  and  priorities  to 
install  significantly  greater  citizen  rights  in  the  Center's  operations,  and  that 
this  will  not  take  place  any  sooner  —  or  later  —  as  a  result  of  the  Center's 
plans  for  further  computerization. 

B.  The  Dr.  Martin  Luther  King  Jr.  Health  Center  is  a  federally-funded,  private 
facility  providing  ambulatory  care  in  a  high-poverty  area  of  the  South  Bronx,  in 

New  York  City;  it  supplies  comprehensive,  family-centered  health  care  to  approximately 
40,000  registered  patients,  with  a  staff  of  450.     Computer  use  has  been  of  the 
"mainstream"  variety,  but  this  Center's  emphasis  on  the  health- team  approach  to  care, 
its  heavy  use  of  community  people  in  staff  and  decision-making,  and  its  innovative 
policies  and  practices  as  to  patient  rights  presents  a  fusion  of  computer  technology 
aind  citizen  rights  that  is  very  different  from  that  of  Los  Angeles  Medical  Center, 
even  allowing  for  the  differences  between  acute  and  ambulatory  care.     The  report 
regards  as    exemplary  the  King  Center's  philosophy  that  machines  must  facilitate 
rather  thsin  weaken  the  Center's  basic  commitment  to  patient  dignity  and  social 
advocacy. 

C.  The  Kaiser-Permanente  Medical  Care  Program  offers  the  experience  of  a  five- 
year,  "leading-edge"  project  on  computerized  patient  records  in  the  Oakland-San 
Francisco  area,  which  was  aimed  at  eventually  creating  a  "hospital  information 
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system."    As  a  pre-paid  medical  plan  that  is  both  medical  provider  ajid  insurer, 
Kaiser  serves  primarily  middle  class  and  unionized  workers,  and  its  health  care 
has  been  excellent.     It  gave  careful  and  effective  attention  to  citizen  rights 
in  the  Oaklajid  project,  especially  as  to  access  controls  over  patient  data  stored 
in  the  computer  system.     The  federal  grant  to  Kaiser  was  not  renewed  in  1973,  and 
while  the  report  discusses  the  different  explanations  for  this  withdrawal  of  funds, 
the  treatment  of  the  Kaiser  project  underscores  the  uncertainty  of  funding  and 
organizational  problems  that  face  leading-edge  projects  in  the  hospital  field  today. 

D.  The  U.S.  Indian  Health  Service  operates  an  advanced  health  information 
systems  project  in  Tucson,  Arizona  that  maintains  integrated,  on-line  medical  records 
for  approximately  10-12  thousand  Papago  Indians  in  Southern  Arizona.     Though  this 
has  helped  greatly  with  some  of  the  special  problems  of  record-keeping  raised  by  an 
itinerant  patient  population,  and  has  generated  excellent  administrative  reports, 

the  computer  project  has  not  been  able  to  do  much  about  the  desperate  medical 
condition  of  American  Indians  in  Arizona  and  elsewhere  and  the  glaring  inadequacy  of 
federal  funds  and  facilities  being  provided  to  cope  with  these  health  problems ;  in 
fact,  the  improved  reporting  only  highlights  the  problems  more  sharply.     The  study 
found  that  the  Indian  Health  Service  has  been  sensitive  to  special  Indian  attitudes 
on  privacy  but  that  problems  of  confidentiality  of  records  and  issues  of  patient 
access  remain.     These  are  now  being  addressed  under  the  new  provisions  of  the 
Federal  Privacy  Act  of  1974,  and  the  report  notes  some  of  the  initial  problems  that 
have  arisen  in  implementing  those  policies  in  the  Indian  Health  Service. 

E.  The  Multi-State  Information  System  (MSIS)  is  an  automated  information  system 
containing  records  on  about  400,000  mental  patients.     It  serves  both  administrative 
and  research  purposes  for  participating  institutions  (primarily  state  and  private 
mental  health  facilities  in  the  Northeast)  and  the  research  activities  of  the 
developer  and  manager  of  the  system,  the  Information  Sciences  Division  of  Rockland 
Research  Institute,  a  state  facility  in  Orangeburg,  New  York.    MSIS  has  pioneered  in 
securing  a  special  state  statute  to  safeguard  the  confidentiality  of  the  sensitive 
psychiatric  data  that  it  stores.    But  it  has  also  been  the  target  of  considerable 
attack  because  it  creates  a  new  type  of  centralized,  regional  databank  of  identified 
psychiatric  information,  separate  from  and  in  addition  to  the  records  kept  in  the 
participating  mental  facilities.     The  report  notes  that  prividing  strong  safeguards 
for  such  regional  and  national  information  systems  containing  special  medical  data 
is  especially  important  in  the  post-Watergate  climate  of  public  concern  over  govern- 
ment abuse  of  confidential  records. 

F.  Mutual  of  Omaha  is  a  profit-making,  multi-line  insurer  which  is  not  only  the 
largest  provider  of  private  health  insurance  in  the  United  States  but  also  an 
advanced  computer  user.     The  report  traces  the  citizen  rights  issues  involved  in 
underwriting  decisions  and  claims  investigation  at  Mutual,  and  the  compliance  of  the 
firm  with  important  protective  legislation  such  as  the  Fair  Credit  Reporting  Act 

and  the  Federal  Privacy  Act  (the  latter  because  Mutual  is  a  fiscal  intermediary  under 
several  federal  health-payment  programs).     The  report  finds  that  Mutual 's  use  of 
computers  has  followed  rather  than  altered  its  basic  confidentiality  policies ,  has 
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probably  enhanced  the  security  of  subscriber  data,  and  has  not  interfered  with 
Mutual 's  compliance  with  federal  laws.     The  key  issues  of  citizen  rights  facing 
Mutual  and  all  other  health  insurers,  the  study  notes,  are     issues  of  social  policy, 
such  as  how  far  American  society  will  insist  upon  socializing  certain  risks 
(insurance  of  homosexuals,  forbidding  "objective"  but  racially-based  standards,  etc.) 
and  thereby  alter  the  collection  and  use  of  personal  data  that  now  support  industry 
practices  in  these  areas. 

Overall,  the  six  profiles  showed  that  the  deployment  of  computing  and 
communication  by  health  organizations  is  still  essentially  a  matter  of  organizational 
artistry,  not  management  science.     Computerizing  requires  managers  to  exercise  choice 
in  selecting  the  files  and  data  flows  to  automate,  arranging  configurations  of 
hardware  and  terminals,  writing  software,  defining  operator-machine  relationships, 
setting  patterns  of  data-sharing  inside  and  outside  the  organization,  deciding  on 
levels  of  organizational  monitoring  and  reporting,  and  reviewing  what  types  of  data 
collection,  patient  consent,  and  access-to-record  rules  the  organization  tradition- 
ally provided  and  what  it  will  now  provide  in  its  automated  system.    V/hile  some 
important  effects  are  being  exerted  by  new  laws,  the  real  locus  of  decision-making 
today  as  to  how  citizen  rights  will  be  treated  in  these  new  systems  still  lies  with 
organizational  managements. 

Part  IV:  Policy  Alternatives 
Computer  Impact  on  Citizen  Rights 

For  crucial  backdrop,  the  report  notes  the  social  setting  in  which  health-care 
computerization  is  unfolding:  distrust  of  the  computer  by  various  disadvantaged  groups 
as  an  instrument  that  continues  discriminatory  practices  against  them;  widespread  pub- 
lic skepticism  about  the  delivery  and/or  value  of  many  "data-based"  government  social 
programs;  general  distrust  of  the  government's  motives  and  respect  for  confidentiality 
rules,  in  the  post-Watergate  mood;  rising  "consumerist"  challenges  to  many  traditional 
practices  in  the  health  field;  and  a  clear  public  consensus  by  the  mid-1 970 's  that 
rules  to  protect  citizen  rights  must  be  instituted  when  large-scale  systems  of  personal 
data  are  instituted  by  government  agencies  and  private  organizations. 

Turning  to  the  impact  of  computer  use  in  health  care,  the  report  found  that  most 
cases  of  actual,  harm  involving  individuals  were  still  arising  from  manual  records. 
These  remain  the  places  where  most  sensitive  medical  records  and  health  data  are  stored 
and  through  which  transfers  of  data, are  still  effectuated.     The  project  also  found  that, 
as  a  whole,  computerized  health  records  are  more  securely  kept  aind  processed  today  than 
manual  records,  with  instances  of  leakage  or  misuse  discovered  by  the  project  almost 
always  taking  place  in  manual  files. 

The  report  concludes  that. the  main  problem  today  with  use  of  automated  medical 
records  involves  potential  harm  -  the  creation  of  health  data  systems  that  many  health 
professionals,  citizen  groups,  and  individuals  directly  affected  by  such  systems  con- 
sider to  be  threats  to  basic  rights. 

The  report  then  presents  descriptions  of  some  two  dozen  selected  episodes  in  which 
government  agencies  or  private  organizations  either  announced  or  set  up  health  data 
systems  only  to  encounter  concerted  opposition  from  various  local  groups  for  failing 
to  define  and  safeguard  citizen  rights  in  those  ventures.     Among  the  data  systems 
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described  are  state  health  department  discharge  reports;  state  mental  health 
department  case  reporting  files;  state  welfare  department  client-services  reports; 
medical  notations  in  juvenile  court  and  police  records;  state  data  systems  on 
handicapped  children;  state  "abortion  surveillance"  reporting;  city  and  state 
registries  for  fetal  death,  child  abuse,  drug  prescriptions,  and  narcotics  treatment 
state  databanks  consolidating  records  on  all  social  services  received  by  state 
residents;  state  benef iciary-explsination  mailings  to  identify  provider  fraud;  and 
the  Medical  Information  Bureau  system  for  life-insurance  compaxiy  data  exchange. 

After  analyzing  what  had  happened  and  why  in  these  episodes,  the  chapter 
concluded : 

"Most  computerized  health  data  systems  are  being  created  or  expanded  without 
sufficient  consultation  in  advance  with  groups  representing  citizen  rights  and 
doctor-patient  interests,  and  without  some  kind  of  proceeding  open  to  the  general 
public.     Most  data  systems  lack  sufficiently  developed  analyses  of  how  much  arid 
what  kind  of  identified  personal  data  they  really  need  to  perform  their  function. 
Even  when  properly  defined,  most  data  systems  fail  to  adopt  sufficiently  precise 
standards  of  confidentiality,  controlling  uses  within  the  organization  and  release 
of  identified  data  to  third  parties.     When  it  comes  to  rules  for  permitting  patient 
access  to  their  own  records,  very  few  computerized  organizations  have  adopted 
procedures  responsive  to  those  patients  who  ask  for  and  insist  upon  access. .. .What 
we  have  today  are  ambiguous  and  ill-defined  systems  that  leave  people  uncertain  and 
fearful  about  their  capacity  to  control  the  circulation  of  their  medical  and  health 
data." 

Comparisons  With  Other  Democratic  Nations 

To  compare  American  progress  in  health-care  automation  and  protection  of 
citizen  rights  with  the  experiences  of  other  industrial  democracies,  the  report 
surveyed  these  issues  in  approximately  two  dozen  other  nations,  presenting  country 
reports  on  six  of  these t  Britain,  Canada,  West  Germany,  Australia,  France,  and 
Sweden. 

As  far  as  computer  use,  the  main  conclusions  of  the  survey  are  that  automation 
is  extensive  and  well-established  in  the  health  institutions  of  these  nations  but 
is  still  heavily  centered  on  administrative  and  laboratory  applications  in  hospitals 
and  administrative  applications  in  health-insurance  programs;  that  leading-edge 
hospital  systems  and  regional  health  information  ^sterns  are  still  in  experimental 
stages  with  their  work  on  patient  records,  though  these  are  aided  by  the  presence 
of  unique  citizen  numbering  practices;  and  that  automation  efforts  have  encountered 
many  of  the  same  problems  of  proving  cost- justification,  overcoming  professional 
opposition  to  computers,  and  competing  for  funds  with  other  social  programs  as  in 
the  United  States. 

As  to  protection  of  citizen  rights,  the  report  finds  that  public  debates  over 
protection  of  privacy  have  followed  the  same  patterns  in  these  nations  as  in  the 
United  States;  that  many  of  these  nations  have  developed  principles  to  be  followed 
in  computerized  data  systems  that  closely  resemble  the  American  concepts  of  fair 
information  practices  established  by  the  Federal  Privacy  Act  of  1974;  and  that  it  is 
in  the  mechaniaras  to  install,  administer,  and  enforce  those  principles  that  the  main 
differences  lie  between  the  United  States  approach  and  that  of  other  industrialized 
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democracies.    As  a  prime  example,  the  report  describes  the  data  inspection  and 
registration  approach  taken  by  Sweden  and  how  this  has  been  applied  so  far  to 
medical  records  and  hospital  systems.     This  section  concludes  by  noting  that  most 
Western  nations  are  at  the  same  stage  as  the  United  States  in  this  area,  aware  of 
the  problems  but  just  beginning  to  enact  and  administer  protective  laws  to  safeguard 
I    individual  rights  in  steadily-expanding  health  data  system. 

!    Policy  Analysis  and  Recommendations 

I  The  concluding  chapter  begins  by  stating  that  no  single  law,  judicial  ruling, 

I   regulatory  action,  or  organizational  policy  can  hope  to  deal  with  the  tremendously 

varied  and  complex  issues  of  citizen  rights  in  health  record-keeping;  it  will  take  a 
j   mosaic  of  policy  actions,  over  time,  to  do  what  is  needed.     However,  the  report 
:    stresses  that  these  actions  must  begin  to  be  taken  now,  rather  than  assume  there 
i    is  time  to  wait  until  national  health  insurance  is  enacted  or  a  reorganization  of 
I    the  American  health-care  system  is  completed. 

I  As  background,  the  report  presents  a  set  of  concepts  that  have  developed  during 

j   the  past  few  years  as  basic  principles  to  be  followed  by  any  lEirge-scale  data  system 
'   using  personal  records.     These  sire;  adopting  a  "contract"  as  well  as  civil-liberties 
I   theory  of  informational  privacy;  recognizing  certain  special  dangers  in  automated  data 
systems;  setting  primary  responsibility  with  the  "keeper"  of  each  data  system; 
identifying  a  legal  duty  to  take  reasonable  care  in  the  use  of  personal  data  and 
specifying  the  standards  required  to  meet  such  a  duty  in  each  field;  issuing  public 
notices  and  privacy-impact  statements  when  data  systems  are  created  and  expanded;  and 
providing  independent,  outside  reviews  of  the  operations  of  each  data  system. 

Applying  these  concepts  to  health  data  systems,  the  report  presents  12  major 
principles  that  ought  to  be  followed  in  the  management  of  data  systems  in  the  health 
field,  and  discusses  alternative  ways  that  these  principles  might  be  carried  out. 
I   The  12  principles  are: 

1 .  There  should  be  a  procedure  for  issuing  a  public  notice  and  privacy -impact 
statement  whenever  an  automated  data  system  is  created  in  the  health  field,  filed 
with  an  appropriate  outside  authority  and  communicated  to  axiy  continuing  population  of 
individuals  whose  records  will  be  affected. 

2.  Socially-acceptable  standards  of  relevance  and  propriety  in  the  collection  of 
personal  data  should  be  worked  out  for  data  systems  in  each  of  the  three  zones  of 
health-data  use,  through  public  discussion  and  appropriate  policy-setting  mechaniBms. 

3.  Individuals  should  be  given  a  clearly-written  account  of  how  their  personal 
information  will  be  used  whenever  they  are  asked  to  supply  personal  information  to 
a  health  data  system,  along  with  the  procedures  to  be  followed  before  any  uses  eire 
made  of  their  data  other  than  those  originally  specified. 

k.     Forms  used  to  release  personal  information  from  a  health  data  system  should 
be  for  a  specific  purpose,  describe  the  information  to  be  released,  and  should  be 
limited  in  time,  and  the  individual's  consent  to  such  releases  should  be  informed  as 
well  as  voluntary. 

5.     As  a  general  matter,  patients  should  have  a  right  to  full  information  about 
their  health  conditions.     Where  health  data  is  to  be  used  to  make  judgments  about 
service  payment    and  claims,  or  in  any  non-medical  social  and  governmental  progrsuns. 
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the  individual  should  have  an  absolute  right  to  inspect  what  is  to  be  released  from 
his/her  record.     In  chronic  and  acute  care,  patients  should  also  have  a  right  to  see 
any  part  of  the  medical  record,  including  the  medical  professional's  working  notes, 
if  the  patient  insists  upon  this  after  the  medical  professional  has  had  a  chance  to 
explain  directly  to  the  patient  why  he  or  she  feels  that  such  disclosure  would  not  be 
in  the  patient's  best  medical  interest.    A  special  procedure  is  suggested  for  patient- 
access  problems  in  psychiatric  care. 

6.  Managers  of  health  data  systems  must  take  steps  to  see  that  personal  records 
are  as  accurate,  timely,  aind  complete  as  the  uses  to  which  they  are  being  put  require 
for  protection  of  individual  rights. 

7.  Data  security  measures  must  be  taken  to  control  access  according  to  the 
policies  set  by  law  or  by  management,  and  the  adequacy  of  those  measures  will 

be  measured  by  the  previous  history  of  threats  to  data  confidentiality  in  that  type 
of  orgsinization. 

8.  Health  data  systems  should  conduct  special  orientation  and  training  programs 
to  inculcate  respect  for  citizen  rights  among  their  staffs  and  to  deal  with  problems 
that  may  arise. 

9.  Each  health  data  system  should  prepare  and  distribute  a  patient's  rights 
handbook,  and  install  a  readily-available  and  independent  patient  rights  representative 
in  the  organization. 

10.  Because  new  issues  are  posed  whenever  health  data  systems  adopt  new  file 
applications,  there  should  be  provision  for  periodic  independent  review  of  each 
system. 

11.  Special  efforts  should  be  made  so  that  confidentiality  rules  do  not  interfere 
with  the  public's  right  to  know  what  is  being  done  by  government  agencies  or  by  private 
recipients  of  government  funds,  and  to  carry  out  critical  oversight  functions  in  the 
public  interest. 

12.  The  importance  of  health-care  evaluation  and  medical  research  calls  for 
developing  special  procedures  so  that  these  activities  can  be  carried  on  without 
jeopardizing  citizen  rights. 

Recognizing  that  the  job  of  refining  and  applying  these  principles  is  a  long-range 
task,  the  report  notes  some  areas  of  priority  for  current  action.     On  the  legislative 
front,  these  include  activities  such  as  removing  the  exclusion  of  medical  information 
from  consumer  rights  under  the  Federal  Fair  Credit  Reporting  Act?  adopting  new  state 
medical  confidentiality  laws  and  medical-research  privilege  statutes;  supporting 
enactment  of  fair  information  practices  laws  in  the  45  states  that  do  not  have  these  j 
and  writing  more  explicit  citizen  rights  guarantees  than  have  yet  been  included  in  the 
major  pending  b ills  to  create  national  health  insurance.     On  the  judicial  front,  the 
report  recommends  development  of  a  legal  duty  by  health  organizations  to  manage  their 
data  systems  according  to  standards  of  reasonable  care,  evolved  by  judicial  definition 
in  test  cases.    For  organizations  operating  health  data  systems,  the  report  urges  a 
full-scale  "privacy  audit."    It  also  urges  sustained  activity  by  public  interest  groups, 
noting  particularly  the  critical  role  played  during  the  past  few  years  by  the  American 
Civil  Liberties  Union,  and  the  important  potentiality  in  the  newly-formed  National 
Commission  on  Confidentiality  of  and  Access  to  Health  Care  Records. 
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The  report  concludes  with  this  comment* 

"It  is  the  custom  of  Americans  to  believe  that  no  'lady-or-the-tiger '  choice 
has  to  be  made  between  science  and  liberty.    For  200  years,  in  the  tradition  of 
Franklin  and  Jefferson,  we  have  hammered  out  legal  rules  that  allowed  each 
successive  wave  of  invention  to  realize  its  potential,  but  also  required  each  to  be 
brought  under  the  rule  of  law.     Sometimes  it  took  a  while  for  the  principles  of 
regulation  to  become  clear,  and  we  have  come  to  realize  that  the  awesome  effects 
of  contemporary  technology  give  us  less  lead  time  for  social  learning  and  regulatory 
response  than  we  had  in  earlier  eras.     But  that  is  the  challenge  we  face,  and  there 
are  promising  signs  that  our  society  understands  how  important  it  is  to  develop,  soon, 
the  standards  by  which  we  can  pursue  the  benefits  of  both  science  and  liberty  in  the 
field  of  health  care." 


XX 


ABSTRACT 


This  report  investigates  the  impact  of  computers  on  citizen  rights  in  the  health 
record-keeping  area.     Under  Dr.  Alan  F.  Westin's  direction,   from  July  of  1974  to 
April  of  1976,  a  small  interdisciplinary  team  did  the  following:     (1)  examined 
published  literature  from  medicine  and  health,   law,  computing,  and  social  science; 
(2)  conducted  interviews  with  major  computer  manufacturers,   systems  developers, 
health  professionals  and  civil  liberties,  public  interest,  consumer,  and  minority- 
rights  groups;    (3)  made  on-site  visits  to  six  representative  health-care  organizations 
using  computers  to  handle  personal  records;    (4)  corresponded  with  70  organizations 
in  the  health  field;  and  (5)   subjected  an  initial  draft  report  to  review  by  a  con- 
ference of  experts  in  September  1975  and  subsequently  by  about  50  outside  reviewers. 
The  findings  of  this  investigation  were  then  combined  into  this  four-part  report. 
Part  One  describes  the  world  of  medical  data  and  citizen  rights  within  the  framework 
of  three  zones--primary  health  care  (by  health  professionals) ,  service  payers  and 
health  care  reviewers,   and  social  uses  of  health  data  (such  as  in  employment,  life 
insurance,  and  welfare);  Part  Two  treats  patterns  of  computerization  in  health  care 
in  each  of  the  above  zones;  Part  Three  contains  the  profiles  of  the  six  health-care 
organizations  that  were  studied  in  depth;  and  Part  Four  analyzes  the  impact  of 
computerization  on  personal  health  records,  presents  comparisons  with  six  other 
democratic  nations,  and  states  12  recommended  management  principles  for  health  care 
data  systems.     The  report  also  contains  a  28  page  bibliography  and  twelve  appendices 
with  support  documents  and  information. 


Key  Words:     Citizen  rights;   computers;   confidentiality;  data  systems;  health  records; 

information  policy;  management  principles;  medical  records;  privacy; 
record-keeping  practices;  security. 
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INTRODUCTION 

Background  and  Ob.-iectives 

In  considering  which  major  field  of  record  keeping  about  individuals  to  use  as 
the  subject  for  our  pilot  study,  we  had  little  trouble  in  selecting  health-care  as 
an  ideal  candidate.     Since  every  person  undergoes  medical  treatment  from  infancy 
to  death,  health-care  is  a  universal  experience.     Since  the  use  of  health-care 
data  affects  everyone's  rights,  benefits,  and  opportunities  in  the  larger  society, 
this  presents  all  the  subtle  and  difficult  problems  of  how  to  regulate  secondary 
uses  of  personal  information.     Though  there  had  been  some  valuable  writing  about 
medical  data  and  privacy  by  1974,  when  this  project  began,  the  field  had  not  been 
as  extensively  studied  and  publicly  discussed  as  many  others,  such  as  law  enforce- 
ment or  credit  reporting.    Finally,  there  was  reason  to  believe  that  the  potential 
existed  for  developing  consensus  among  medical  professionals,  policy-makers,  and 
public  interest  groups  as  to  the  emerging  civil  liberties  problems  in  health-data 
systems  and  the  range  of  alternative  policies  that  could  deal  effectively  with 
those  dangers. 

TVius  we  chose  health  care.     We  did  so  with  an  awareness  that  the  field  was  in 
a  sta-o  of  major  change  in  three  basic  dimensions:  the  goals  and  organization  of 
the  nation's  health  delivery  system;  the  application  of  computer  technology  in 
medical  services  and  health-data  reviews;  and  the  status  of  the  individual's  right 
to  control  the  uses  made  of  his  or  her  personal  health  data. 

1.  That  our  health  care  system  is  moving  toward  a  fundamental  reorganization 
needs  little  documentation.     The  soaring  costs  of  health  care,  the  uneven  and 
distorted  distribution  of  services,  and  rising  public  expectations  as  to  health 
care  have  carried  us  to  the  brink  of  enacting  national  health  insurance.     Such  a 
new  method  of  financing  American  health  care  for  most  citizens  will  increase  the 
federal  role  in  paying  for  and  in  assuring  the  quality  of  medical  care;  will  foster 
new  insurance  and  organizational  mechanisms  providing  supplements  to  the  federal 
minimum  system;  and  will  lead  to  basic  reconsideration  of  the  ways  in  which  health 
care  is  conceived,  organized,  delivered,  evaluated,  and  publicly  regarded. 

Wholly  apart  from  national  health  insurance,  leading  voices  in  the  health  field 
have  called  for  reshaping  health  institutions,  linking  environmental  controls  more 
closely  to  preventive  health,  experimenting  with  new  forms  of  health  screening, 
and  launching  far  more  comprehensive  research  into  health  matters  than  has  been 
traditional  in  our  society.    More  changes  are  expected  during  the  next  decade  in 
our  health  care  system  than  we  have  seen  since  World  War  II,  or  even  longer. 

2.  Computer  applications  in  health  care  are  expected  to  undergo  a  similarly 
major  shift.     The  new  financing  and  payments  mechanisms  under  national  health 
insurance  will  explode  claims  processing,  and  the  requirements  of  quality-care 
review  already  under  Professional  Standards  Review  GrEanlzation  (PSRO)  for  Medicare 
wlUadd  tremendously  to  the  transactional  flows.  These  two  developments  alone  account 
for  the  judgment  of  most  computer  forecasters  that  the  area  of  health-care 
computing  is  about  to  undergo  the  kind  of  expansion  that  marked  data  processing  in 
banking  or  law  enforcement  in  the  past  decade. 

Many  experts  believe  that  the  next  decade  will  see  major  advances  in  a  host 
of  application  areas  in  health  care  that  have  been  slow  in  unfolding  so  far  — 
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hospital  information  systems ,  regional  health  data  systems ,  special  health  registers 
for  problem  areas,  lifetime  personal  medical  histories,  and  many  others.  The 
citizen  in  1980  or  1985 >  it  is  predicted,  will  feel  the  presence  of  computers 
continually  throughout  his  or  her  health-care  contacts ,  from  the  terminal  that  will 
take  a  medical  history  in  the  doctor's  office  or  clinic  to  the  on-line  medical 
history  that  will  be  available  whenever  or  wherever  health  catastrophes    occur  to 
a  person,  or  to  the  machines  that  will,  Star-Trek  style,  monitor  vital  signs  and 
changes  as  patients  lie  in  hospital  beds. 

3.  Finally,  as  we  noted  in  the  Preface,  the  United  States  is  now  entering  a 
period  of  new  legal  regulations  and  organizational  policies  as  to  personal  privacy. 
The  Federal  Privacy  Act  of  1974  was  a  fundamental  breakthrough,  representing 
Congress'  finding  that  new  legal  standards  should  be  installed  to  protect  citizens 
from  misuse  of  personal  data  by  federal  agencies.    A  Privacy  Protection  Study 
Commission  created  by  the  1974  Act  has  been  charged  by  Congress  with  the  duty  of 
conducting  a  broad  two-year  study  of  privacy  and  record-keeping  in  state  and  local 
government  and  among  private  organizations ,  with  a  long  list  of  particularly 
sensitive  areas  to  be  explored,  one  of  which  is  the  medical  field. 

Where  medical  records  are  involved,  serious  questions  have  been  raised  before 
the  public,  in  the  post-V/atergate  setting,  as  to  how  confidentiality  can  be 
assured  in  a  national  health  insurance  system,  as  well  as  what  is  happening  already 
to  the  confidentiality  of  personal  medical  data  as  computerized  data  collection  and 
exchange  has  spread  in  the  health  care  environment.    Another  aspect  of  citizen 
rights  in  health  care  —  the  right  of  patients  to  see  the  medical  records  assembled 
on  them  —  is  becoming  a  well-articulated  demand  of  various  consumer-oriented  and 
civil  liberties  groups,  paralleling  the  "right-of-access"  issue  in  many  other 
information  systems. 

Predictably,  there  are  divergent  views  among  observers  as  to  the  nature  and 
extensiveness  of  threats  to  privacy  in  various  new  health  care  programs,  and  in  the 
growth  of  automated  data  systems.    But  there  is  widespread  agreement  that  dealing 
wisely  and  effectively  with  the  privacy  "issue"  is  a  vital  matter,  not  only  to  the 
public's  confidence  in  new  health  care  institutions  in  the  coming  decade  but  also 
to  the  protection  of  fundamental  citizen  rights. 

The  time  is  ripe,  therefore,  for  focusing  expert  and  public  attention  on  these 
issues  before  changes  in  health  care  financing  and  review  are  enacted,  before  the 
new  wave  of  computer  applications  and  information  systems  unfold,  and  before 
arrangements  to  incorporate  national  patient  identifiers  and  file-linking  arrange- 
ments in  the  health  field  are  put  into  place.    Helping  to  sharpen  that  focus, 
through  an  inter-disciplinary  research  effort  and  preparation  of  an  agenda  of 
policy  alternatives  for  the  next  decade,  is  the  objective  of  this  report. 

Basic  Assumptions 

We  began  our  analysis  of  computer  impact  in  the  health-care  area  with  some 
guiding  assumptions  derived  from  the  National  Academy  of  Sciences '  study  of  computers 
and  privacy  in  1969-1972.     (That  study  had  included  health-care  organizations  among 
its  15-20  major  areas  of  personal  record-keeping  in  American  society,  with  site 
visits  that  covered  hospitals,  health  insurance  companies,  local  and  state  govern- 
ment health  agencies,  employee  medical  departments  maintained  by  private  employers 
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and  government  agencies,  and  medical  services  in  schools  and  universities).  We 
regarded  the  findings  of  the  HAS  report  as  general  probabilities,  subject  to 
verification  or  alteration  on  the  basis  of  our  detailed  researches  into  health-care 
automation  in  1974-75.     The  HAS  findings  we  considered  particularly  relevant  to  our 
project  were  these: 

A.  That  computerization  of  personal  data  in  the  great  majority  of  organizations 
carries  forward  whatever  legal  rules,  social  norms,  and  organizational  policies  as 
to  citizen  rights  (for  better  or  for  worse)  that  prevailed  in  each  type  of 
organizational  activity  in  its  manual-record  milieu.     That  is,  computerization  as 
such  has  not  led  to  either  "stronger"  or  "weaker"  policies  with  regard  to  citizen 
rights.    Unless  such  forces  as  new  laws,  public  protests,  or  pressures  from  within 
by  professional  workers,  intervened  to  influence  orgajaizational  managements, 
automated  systems  adopted  existing  policies  as  to  what  information  was  collected, 
how  it  vjas  used  within  the  organization,  with  what  outsiders  the  data  was  shared, 
and  what  provisions  were  made  for  access  and  review  by  the  individual. 

B.  However,  computerization  spread  through  the  world  of  organizational  record- 
keeping during  a  period  of  drastic  change  in  American  values  and  social  allocations. 
In  the  past  decade,  groups  formerly  discriminated  against  in  the  awarding  of 
society's  benefits  and  opportunities  have  demanded  and  won  recognition  of  their 
right  to  equal  treatment.    Essentially,  this  means  that  the  collection  of  personal 
data  by  government  agencies  or  private  organizations  on  matters  of  religion,  race, 
sex,  political  activity,  cultural  style,  or  sexual  preference  is  no  longer 
considered  legitimate  unless  it  can  be  shown  that  such  data  are  not  being  used  by 
such  organizations  to  make  discriminatory  judgments.    Moreover,  the  record  systems 
of  most  large  organizations  still  contain  a  great  deal  of  subjective  and  judg- 
mental data  about  individuals  collected  in  the  "earlier  era";  unless  systematic 
purging  of  such  data  is  undertaken  in  both  manual  and  automated  files,  there  are 
serious  risks  that  individuals  will  continue  to  have  judgments  made  about  them  on 
the  basis  of  improper  information.     Furthermore,  the  public  had  registered  in  the 
1960's  its  clear  dissatisfaction  with  the  creation  of  secret  data  systems  about 
citizens,  whether  by  police  or  commercial  reporting  agencies,  as  well  as  the 
making  of  evaluative  decisions  about  individuals  in  reliance  on  records  that  the 
individual  did  not  have  an  opportunity  to  inspect,  with  procedures  for  correction 
should  there  be  inaccurate,  incomplete,  or  misleading  information  in  them. 

C.  The  NAS  study  found  that  computer  use  had  not  resulted  by  1972  in  the 
merger  of  all  files  within  an  organization  or  at  a  level  of  government  in  the 
kind  of  "one-big-databank"  approach  that  was  advocated  by  some  computer 
enthusiasts  in  the  late  1960's  and  early  70' s,  and  which  had  been  properly  viewed 
with  alarm  by  social  commentators  aware  of  how  little  law  was  then  available  to 
control  such  greatly  enhanced  data  systems,  if  they  did  come  into  existence. 

D.  The  NAS  study  found  that  automation  seemed  to  be  creating  certain  effects 
that  did  deserve  close  attention.     In  most  organizations,  computerization  was 
leading  to  faster  transmission  of  data  and  faster  decision-making;  more  complete 
and  up-to-date  records  on  persons;  greater  "massage"  of  personal  data  once  it  '.vas 
collected;  the  creation  of  some  large  centrally-directed  regional  or  national  data 
networks;  and  the  creation  of  some  large  personal  data  systems  that  would  probably 
have  been  too  costly  or  cumbersome  to  have  been  initiated  under  manual  procedures. 
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None  of  these  effects  were  seen  by  the  MS  study  to  be  automatically  bad  for  civil 
liberties,  but  they  did  enhance  the  efficiency  of  governmental  and  private  organiza- 
tions in  the  use  of  personal  data  at  a  time  of  high  public  distrust  of  government 
and  private  institutions,  especially  for  their  intrusion  into  zones  of  personal  and 
group  privacy.     This  made  even  more  imperative  the  establishment  of  clear 
public  policies  to  control  the  automated  data  systems  that  would  be  steadily 
expanding,  and  growing  far  more  sophisticated,  in  the  late  1970 's  and  80' s. 

E.  The  NAS  study  concluded  that  in  the  mid-1970' s,  most  controversial  issues 
of  citizen  rights  in  re cord- systems  would  still  involve  manual  records  rather  than 
the  automated  systems.    This  was  essentially  because  the  more  narrative  and 
subjective  records  in  each  type  of  organization,  ;*hich  usually  involved  the  most 
critical  civil  liberties  issues,  had  not  yet  been  automated.     Thus  when  citizen 
rights  questions  were  addressed,  the  NAS  study  concluded  that  the  first  priority 
was  to  re-examine  data  policies  without  regard  to  whether  the  storage  and  processing 
medium  was  manual  or  automated.    Once  proper  rules  had  been  set,  policy-makers 
should  then  address  what  special  safeguards  and  procedures  were  necessary  for 
automated  files,  and  set  these  into  place  as  general  system  requirements. 

Methodology 

We  followed  the  general  methodology  used  by  the  National  Academy  of  Sciences' 
Project  on  Computer  Databanks.*      As  applied  to  the  health  care  field,  this 
entailed  four  steps: 

1.  Documenting  the  patterns  of  record-keeping  about  people  that  prevailed  in 
the  health  care  field  before  automation  arrived,  including  the  realities  of 
organizational  behavior  and  the  civil  liberties  rules  that  were  applied  in  that 
milieu. 

2.  Describing  the  reasons  why  health  care  organizations  have  moved  to  adopt 
computer  technology,  tracing  the  changing  patterns  of  computer  applications  down 
to  the  present,  and  presenting  concrete  case  studies  of  organizations  that  have 
undergone  these  developments,  including  their  handling  of  citizen  rights  issues. 

3.  Identifying  the  effects  of  computerization  on  the  status  of  citizen 
rights  in  the  health  area,  including  in  this  estimate  an  analysis  of  changing 
social  norms,  public  expectations,  and  legal  conceptions  of  these  rights  during 
the  highly  dynamic  period  of  the  past  decade. 

4.  Posing  the  policy  alternatives  that  face  American  society  in  this 
field  if  new  standards  and  procedures  are  to  be  adopted,  by  organizational 
initiative  and/or  public  regulation,  to  assure  the  vitality  of  citizen  rights 
guarantees  in  the  increasingly  computerized  ethoS  of  health  care  record  keeping. 

We  have  also  employed  the  basic  research  techniques  of  the  National  Academy 
of  Sciences'  study.    Following  a  thorough  inspection  of  the  published  writings  on 
our  topics  in  the  literature  of  health-care,  law,  computers,  and  social  sciences,  we 
held  briefing  sessions  with  three  major  computer  manufacturers  (UNIVAC,  I.B.M.,  and 
Honeywell)  to  discuss  computer  applications  in  health  care.     We  then  made  site 
visits  to  six  organizations  whose  experiences  would  provide  insight  into  the  way 


*  Alan  F.  Westin  and  Michael  A.  Baker,  Databanks  in  a  Free  Society  (N.  Y. : 
Quadrangle,  1972). 
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computerization  and  citizen  rights  developments  were  taking  place  in  the  real 
world;  these  site  visits  were  written  up  as  case  studies  and  appear  in  Part  III 
of  this  Report. 

For  general  background,  we  contacted  about  70  organizations  in  the  health 
care  field,  soliciting  any  policy  statements,  research  studies,  or  other  material 
that  they  had  on  the  issues  of  confidentiality  and  computerization.     We  also 
conducted  a  survey  of  the  national  and  state  affiliate  offices  of  the  American 
Civil  Liberties  Union,  to  obtain  instances  of  complaints  about  violations  of 
confidentiality  or  refusals  of  patient  access  to  records.     Similar  inquiries  were 
made  of  public- interest  law  firms,  consumer  organizations,  minority  rights  groups, 
and  regulatory  agencies.    Another  technique  that  we  used  was  to  devise  a  form 
soliciting  reports  of  violations  of  citizen  rights  in  the  use  of  personal  medical 
data,  in  either  manual  or  computerized  settings;  we  distributed  this  form  at 
several  national  meetings  of  health  care  organizations  during  1974-75.* 

For  comparisons  with  trends  in  computer  use  and  citizen  rights  protections  in 
the  health  care  systems  of  other  democratic  nations,  we  corresponded  with  medical 
societies,  government  experts,  lawyers  groups,  and  civil  liberties  organizations 
in  about  a  dozen  nations.    We  also  had  contacts  with  the  Computer  Utilization 
Group  of  the  O.E.C.D.  in  Paris,  through  its  director.  Dr.  Hans  Gassmann.  The 
patterns  of  experience  in  a  group  of  selected  nations  appears  in  Chapter  12  of  the 
-  Report. 

We  regarded  a  careful  review  of  the  first  draft  of  this  report  by  a  group  of 
experts  representing  the  interested  parties  in  health  care  and  citizen  rights  to  be 
a  vital  part  of  the  project  methodology.     This  was  not  only  for  the  usual  purpose  of 
obtaining  corrections  of  fact  and  reactions  to  specific  judgments  and  recommendations 
but  also  to  test  the  range  of  agreement  as  to  problems  and  solutions  among  medical 
specialists,  government  health  officials,  lawyers,  civil  liberties  groups,  computer 
experts,  and  similarly  important  participants  in  the  standards-setting  process. 

This  was  done  in  two  parts.    On  September  15-17,  1975,  a  review  conference  of 
35  participants,  under  the  chairmanship  of  Dr.  Vernon  Wilson,  was  held  at  the 
National  Bureau  of  Standards,  in  Gaithersburg,  Maryland.     Copies  of  the  report  were 
also  sent  out  for  written  comments  to  a  group  of  about  50  additional  specialists. 
(a  list  of  these  reviewers  is  contained  as  an   Appendix,  and  we  are  very  grateful 
to  them  for  having  made  such  a  useful  contribution  to  the  project.)    We  found  that 
there  was,  indeed,  a  very  large  area  of  agreement  among  these  reviewers  on  how  to 
approach  the  issues  in  the  field,  and  we  discuss  this  situation  in  the  final  chapter. 

Following  the  reviews,  the  report  was  completely  revised  by  the  Director  and 
Hs.  Florence  Isbell,  during  the  period  from  September,  1975  to  March,  1976. 

Definitions 

A  last  few  introductory  words  are  in  order  to  define  three  terms  used  in  this 
report  to  represent  the  main  civil  liberties  interests  of  the  citizen  in  personal 
records. 

*See  Appendix"!      for  lists  of  orgajiizations  contacted,  sample  forms,  etc. 
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1.  Privacy  is  the  question  of  what  personal  information  should  be  collected  or 
stored  at  all  for  a  given  social  function.     It  involves  issues  as  to  the  legitimacy 
and  legality  of  organizational  demands  for  disclosure  from  individuals  and  groups, 
and  the  setting  of  balances  between  the  individual's  control  over  the  disclosure 

of  personal  information  and  the  needs  of  society  for  the  data  on  which  to  base 
decisions  about  individual  situations  and  to  formulate  public  policies. 

2.  Confidentiality  is  the  question  of  how  personal  data  collected  for  approved 
social  purposes  shall  be  held  and  used  by  the  organization  that  originally  collected 
it,  what  other  secondary  or  further  uses  may  be  made  of  it,  and  when  consent  by  the 
individual  will  be  required  for  such  uses.     It  is  to  further  the  patient's  willing 
disclosure  of  confidential  information  to  doctors  that  the  law  of  privileged 
communications  developed.     In  this  perspective,     security    of  data  involves  an 
organization's  ability  to  keep  its  promises  of  confidentiality. 

3.  Individual  access  is  the  issue  of  when  individuals  should  know  that  a  record 
has  been  created  about  them,  and  when  they  can  examine  it  in  order  to  check  its 
accuracy,  completeness,  and  the  uses  being  made  of  it.    Fundamentally,  the  claim 

to  access  rests  on  the  due  process  of  law  guarantees  of  the  American  legal  system. 

There  are  other  citizen  rights  issues  in  the  field  of  health  care  that  we  do 
not  cover  here,  basically  because  they  are  not  record-keeping  problems  and  are  not 
being  affected  significantly  by  changes  in  information-handling  technology.  These 
include  the  individual's  right  to  treatment,  informed  consent  for  medical  experimen- 
tation, the  right  to  elect  death,  and  similar  important  questions. 

Finally,  we  will  use  both  the  terms  medical  records  and  health  data  in  oui' 
discussions.     By  medical  records,  we  mean  the  formal  record  of  a  patient's  reception, 
treatment,  and  progress  in  primary  care  settings,  usually  taken  by  various  health 
professionals;  this  will  include  any  personal,  family,  or  social  histories 
acquired  for  patient-care  purposes.    We  use  health  data  to  describe  any  information 
about  a  person's  physical  or  mental  health,  whether  originating  in  a  medical 
record  or  other  source,  that  is  used  to  make  a  judgment  about  an  individual's 
rights,  benefits,  and  opportunities  in  situations  other  than  direct  health  care. 
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*  For  further  refinements  of  these  concepts,  we  include  in  Appendix  2     a  very 
useful  set  of  "Privacy  Definitions"  compiled  by  Dr.  Willis  Ware. 
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Part  One 


The  World  of  Medical  Data 
and 

Citizen  Rights 


INTRODUCTION 

To  measure  the  impact  of  new  computer  and  communication  technologies  on  health 
records  and  citizen  rights,  we  need  a  set  of  baselines.     In  this  case,  we  need 
three  baselines: 

1.  How  were  medical  records  and  health  data  collected,  processed,  used,  and 
circulated  in  American  society  at  the  moment  -  basically  the  past  decade  -  when 
automation  first  began  to  spread  through  the  health  care  field? 

2.  What  were  the  rules  of  law  and  definitions  of  citizen  rights  that  were  applied 
to  such  traditional  patterns  of  medical  record  keeping,  both  in  theory  and  in 
practice? 

3.  What  kinds  of  disputes  over  medical  data  and  civil  liberties  claims  were 
already  arising  when  computerization  arrived? 

Presenting  such  baselines  is  not  a  simple  task.     There  is  no  work  in  existence 
that  describes  comprehensively  how  medical  data  are  generated  and  used  in  American 
society.     Nor  is  the  average  citizen,  or  even  the  average  medical  professional 
or  legal  expert,  aware  of  how  widely  the  individual's  medical  and  health  data  now 
circulate  from  doctors'  offices,  clinics,  and  hospitals  to  the  files  of  insurance 
companies,  health  care  review  committees,  employers,  educational  institutions, 
the  military,  the  police,  credit  bureaus,  government  licensing  agencies,  research 
studies  and  surveys,  and  a  host  of  other  users.     Laying  out  such  a  map  of  medical 
data  uses  and  the  citizen  rights  issues  that  have  been  generated  by  them  is 
therefore  our  first  goal  and  the  topic  of  the  next  three  chapters. 

To  most  people,   "medical  record"  probably  evokes  a  picture  of  a  folder  in  a 
doctor's  office  or  a  chart  on  a  clip-board  in  a  hospital.     Our  common  expectation 
when  we  visit  the  doctor  is  that  we  will  be  asked  majiy  questions — about  childhood 
diseases  and  current  problems,  about  the  health  of  our  parents  and  siblings,  about 
our  age  and  weight,  about  what  we  eat  and  how  much  we  smoke  and  drink.     Then  we 
will  be  poked,  tapped,  finger-pricked  and  examined,  and  the  results  of  all  these 
probings  -  mental  and  physical  -  will  be  entered  into  the  folder. 

Throughout  this  process,  the  patient  is  usually  a  willing  participant.  The 
doctor  needs  to  know,  and  the  patient  accepts  that  need  as  a  vital  ingredient  of 
receiving  good  medical  care.     The  patient  has  the  same  general  expectations  of 
hospital  care,  although  a  lot  more  people  there  need  to  know — nurses  and 
pathologists,  surgeons  and  auiesthesiologists,  and  the  admitting  clerk  who  may 
insist  on  knowing  the  mother's  maiden  .name  before  it  will  be  permitted  that  the 
baby  be  born  or  the  operation  performed.     But  the  probing  is  accepted  here,  too, 
as  part  of  the  bargain  the  patient  strikes «     personal  information  in  exchsinge  for 
medical  care. 

If  reminded,  the  patient  will  also  recall  that  those  who  pay  his  medical 
bills — whether  government  agencies  or  private  companies — need  to  know  why  the 
patient  was  in  the  hospital,  and  for  how  long.     But  the  average  patient  could 
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probably  not  say  with  any  certainty  what  other  information  about  him  or  her  is 
given  to  insurance  payers. 

Beyond  this  direct  experience,  however,  the  concept  of  medical  records  is 
likely  to  be  blurred  for  most  patients.     They  have  made  no  explicit  bargain  that 
their  medical  records  will  be  shared  with  employers,  or  welfare  agencies,  or 
licensing  bureaus,  or  government  departments,  or  a  host  of  other  non-medical 
agencies.     If  the  bargain  is  an  implicit  one,  often  the  patient  is  an  unwitting 
participant  in  the  transaction. 

Part  I  of  this  study  will  trace  the  course  of  medical  records,  beginning  with 
the  patient's  direct  encounter  with  medical  care.     It  will  examine  who  keeps  medical 
records,  how  they  are  kept  and  why  they  are  kept.     The  various  kinds  and  uses  of 
medical  records  are  divided  into  three  zones,  described  below.     As  with  any  such 
arbitrary  system,  some  of  the  items  in  each  of  the  three  zones  defy  neat  labelling; 
many  of  them  overlap;  some  are  discussed  from  several  points  of  view.     Thus,  for 
example,  medical  records  in  law  enforcement  is  discussed  in  Zone  I  as  part  of  a 
physician's  duty  to  report  certain  conditions  to  the  police,  and  again  in  Zone  III 
to  describe  how  law  enforcement  agencies  use  medical  records.     It  is  hoped  that 
the  sense  of  deja  vu  will  be  kept  to  a  minimum,  and  that  where  repetition  is 
unavoidable,  the  reader  will  be  forbearing. 

Zone  I  -  Primary  Health  Care        This  chapter  will  describe  medical  records  that  are 
created  when  a  patient  seeks  health  care  from  a  health  professional — whether  a 
personal  physician,  a  hospital,  a  health  center  or  clinic,  a  college  infirmary,  a 
company  doctor,  etc.     It  is  here  that  the  cycle  of  medical  record-keeping  usually 
begins.    And  it  is  here  that  sensitive  ethical  and  legal  questions  as  to 
confidentiality  and  disclosure  sometimes  pit    the  medical  profession's 
perceptions  of  good  medical  care  against  the  rising  consciousness  of  some  patients 
and  consumer  groups  who  seek  greater  participation  in  medical  decision-making. 

Zone  II  -  Service  Payers  and  Health  Care  Reviewers      This  chapter  will  exsimine  the 
use  of  medical  records  by  those  who  pay  for  medical  care — both  private  insurance 
companies  and  government  programs  such  as  Medicare  and  Medicaid.     It  also  surveys 
voluntary  private  groups  and  government  agencies  that  review  individual  medical 
records  as  part  of  their  efforts  to  analyze  the  quality  of  medical  care  and  to 
determine  whether  hospitals  and  other  health  providers  are  in  fact  delivering  the 
health  care  for  which  they  are  being  reimbursed.     It  is  especially  important  to 
understand  the  current  practices  in  Zone  II,  for  these  two  functions — paying  for 
health  care  and  monitoring  its  quality — prefigure  the  creation  of  a  universal, 
pre-paid  health  insurance  program. 

Zone  III  -  Secondary  Users  of  Personal  Medical  Data      This  chapter  will  discuss  the 
use  of  medical  records  in  the  non-medical  world.    From  "womb  to  tomb,"  -  or  to  put 
it  in  medical  record  terms  -  from  birth  certificate  to  death  certificate,  medical 
records  are  required,  among  other  things,  when  starting  school,  going  into  the 
armed  forces,  getting  married,  travelling  abroad,  getting  a  job  or  a  business 
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license,  driving  a  car,  applying  for  life  insurance,  receiving  government  benefits, 
applying  for  a  security  clearance,  encountering  the  law,  or  going  on  welfare.  It 
is  here  that  breaches  of  confidentiality  and  inaccuracies  in  records  can  exact 
a  painful  human  toll. 

The  chart  below  diagrams  the  flow  of  information  just  described.     The  three 
chapters  that  follow  use  the  items  listed  in  each  Zone  as  chapter  sub-heads. 
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NOTE 


Part  One  draws  on  memoranda  by  project  consultants  Michael  A.  Baker 
("General  Patterns  of  Record-Keeping  About  People  in  the  Health  Care  Field:  The 
Pre-Computer  Baseline")  and  George  J.  Annas   ("Judicial  Treatment  of  Medical  Records 
and  Confidentiality").     These  were  produced  for  the  first  draft  of  this  report, 
and  are  on  file  with  the  Institute  for  Computer  Sciences  and  Technology,  National 
Bureau  of  Standards,  Washington,  D.C.  20234. 
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CHAPTER  1.     ZONE  I  -  PRIMARY  HEALTH  CARE 

What  follows  is  a  description  of  record-keeping  in  the  private  practitioner's 
office,  and  then  a  description  of  the  process  in  hospitals  and  other  health 
centers.     Record-keeping  in  which  institutions  employ  health  professionals  to 
treat  their  special  populations  (e.g.,  schools,  armed  forces,  prisons)  is  handled 
separately,  since  the  existence  of  a  physician- institutional  relationship 
alongside  the  physician-patient  one  provides  a  significantly  different  setting 
for  viewing  ethical  and  legal  problems. 

Record  Keeping  in  Physician's  Offices 

An  estimated  Q0%  of  health  care  is  delivered  by  more  thaji  190,000  private 
practitioners  in  their  offices,  with  over  900  million  patient  visits  to  physicians' 
offices  in  1973. The  most  important  use  of  the  patient's  medical  record  here 
is  as  an  aid  in  diagnosis  and  treatment,  with  the  private  physician  free  to  choose 
whatever  form  of  record-keeping  he/she  wishes.     The  broad  variety  of  record-keeping 
practices  to  be  found  in  private  offices  reflects  differing  medical  philosophies 
as  well  as  the  demands  of  different  kinds  of  medical  practice. 

Some  physicians  use  their  office  records  only  to  jog  their  memories  about  the 
social  and  medical  characteristics  of  patients j  they  provide  care  for  the  most  part 

on  the  basis  of  the  patients'  verbal  reports  of  symptoms  and  their  own  most  recent 
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tests  and  observations. 

Some  physicians,  specialists  for  instance,  see  thousands  of  different  patients 
a  year;  their  record  of  each  patient  is  likely  to  be  very  detailed  as  to  diagnosis 
and  treatment,  but  narrowly  focussed  on  the  specific  problems  referred  to  them. 
Participation  in  group  practice  also  affects  the  character  of  a  physician's  records, 
since  there  is  apt  to  be  greater  demand  for  communication  from  other  physicians  in 
the  group  responsible  for  the  patient's  care. 

Psychiatrists,  psychologists  and  psychotherapists  in  private  practice  vary 
widely  in  the  amount  of  detail  they  record  on  their  patients.     Psychiatrists  are 
MDs,  and  they  often  keep  records  of  their  patients'  physical  ailments,  especially 
where  psychosomatic  problems  are  being  treated.     Some  therapists  tape-record  their 
sessions;  others  keep  but  a  few  notes  in  a  short-hand  only  they  can  decipher. 
Professor  Ralph  Slovenko  notes  that  "It  is  customary  to  keep  records  of 
appointments  and  billings,  but  most  psychoanalysts  and  analytically-oriented 
psychotherapists  make  no  records  or  notes  of  patient  communications."^    Of  those 
who  do,  many  store  such  records  under  code  names  or  numbers. 

Beyond  the  physician's  personal  choice  of  record-keeping  methods,  there  are 
several  other  factors  that  influence  these  activities: 

1.  Third-party  payers      More  than  150  million  people  are  protected  by 
regular  medical  expense  insurance,  which  provides  benefits  toward  physicians'  fees 

h. 

for  non-surgical  care  given  in  the  hospital, home  or  doctor's  office.  The 
information  that  doctors  must  submit  to  insurance  companies  to  justify  payment  for 

Raised  figures  indicate  the  footnotes  located  at  the  end  of  the  chapter. 
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such  office  visits  frequently  requires  making  additional  entries  into  the  patient's 
record. 


2.  Public  Reporting  Requirements      State  statutes  require  a  broad  variety  of 
reporting  by  physicians  to  appropriate  government  agencies.    Among  these  are 
communicable  diseases  such  as  TB,  venereal  disease,  meningitis,  polio,  etcj  wounds 
deliberately  inflicted  with  a  deadly  weapon j  child  abuse  and  neglect;  all  deaths 
that  are  not  "natural",  as  by  drowning,  from  falls,  or  sudden  deaths;  and 
industrial  accidents.     In  addition,  physicians  must  keep  a  record  of  their 
prescriptions  for  narcotics  and  other  dangerous  drugs  in  a  special  register  which 
is  open  for  inspection  by  federal  and  state  authorities.-^ 

It  is  difficult  to  tell  how  strictly  these  reporting  statutes  are  enforced.  In 
a  study  of  237  private  physicians  conducted  by  Consultant  Magazine  in  1972,  it  was 
found  that  while  6o%  of  those  responding  felt  that  venereal  disease  reporting 
should  be  compulsory,  in  fact  only  11%  of  the  physicians  reported  gonorrhea  and 
only  20%  reported  syphilis.^ 

3.  Malpractice  claims      About  60%  of  the  malpractice  claims  made  in  1970  were 
against  physicians  in  private  practice.'     There  has  been  much  professional  discussion 
of  the  sharp  increase  in  malpractice  suits,  and  physiciariS  are  increasingly  aware 
that  their  office  records  are  a  prime  source  of  information  about  the  quality  of 
their  care.     As  a  result,  physicians,  like  hospitals,  are  increasingly  engaging  in 
"defensive  medicine,"  that  is,  the  ordering  of  tests  and  consultations  so  that  the 
record  will  show  the  physician  took  every  reasonable  precaution.    While  it  is 
difficult  to  estimate  the  amount  of  defensive  medicine  that  takes  place,  some 
authorities  claim  that  it  has  at  least  one  beneficial  effect:     the  overhanging 
threat  of  litigation  does  seem  to  encourage  more  methodical  record-keeping. 

Hospital  Record  Keeping 

Thirty  million  patients  are  admitted  each  year  to  the  900  proprietary,  3f500 
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voluntary  and  2,700  governmental  hospitals  which  offer  care  for  acute  conditions. 
The  medical  i-ecords  of  these  patients  may  include  i     identifying  information,  x-rays, 
EKG  and  lab  test  results,  daily  observations  by  nurses,  physical  examination 
results,  diagnoses,  drug  and  treatment  orders,  progress  notes  and  post-operative 
reports  from  physicians,  medical  history  secured  from  the  patient, consent  forms 
authorizing  treatment  or  the  release  of  information,  summaries  from  the  medical 
records  of  other  institutions,  and  copies  of  forms  shared  with  outside  institutions 
for  insurance  purposes.     In  some  cases,  ad  hoc  staff  comments  about  the  patient's 

Q 

character  or  demeanor  are  also  put  in  the  record. 

Hospital  medical  records  vary  considerably,  so  it  is  difficult  to  describe 
the  "typical"  record.     In  some  institutions,  one  could  find  all  of  the  above 
information  in  the  patient's  medical  "jacket"  or  central  file,  atnd  this  could  total 
80  or  100  or  even  150  pages.     In  others,  only  the  patient's  current  condition  is 
described  in  the  medical  record,  but  other  information  is  developed  in  the  files 
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of  the  collection  department  or  the  social  service  department. 


In  most  hospitals,  each  of  several  departments—pharmacy,  social  service, 
billing — maintains  its  own  files,  duplicating  most  of  the  information  stored  in 
the  patient's  central  record.     Often  the  lines  between  social  service,  medical 
and  administrative  records  are  blurred.     The  "medical"  record  may  contain 
information  about  the  patient's  insurance;     the  social  service  file  will  certainly 
contain  some  reference  to  the  patient's  medical  condition j     identification  files 
or  the  daily  bed  census  reports  indicate  the  ward  to  which  the  patient  was  admitted, 
such  as  obstetrics  or  psychiatry . '''^    The  patient's  hospital  record,  then,  is 
really  several  different  overlapping  files,  often  kept  in  separate  places. 

In  many  hospitals,  there  are  central  medical  records  handled  by  medical  record 

administrators,  a  paramedical  profession  developed  over  the  last  fifty  years  along 

with  the  increase  in  size  of  general  hospitals  and  the  specialization  of  the  staff 

within  them.     More  than  11,000  medical  record  administrators  and  technicians  now 

work  full  time  at  supervising  the  filing  of  medical  records,  enforcing  hospital 

rules  about  their  content  and  accuracy,  and  extracting  information  from  them  for 

insurance  and  other  purposes.    About  25%  of  these  persons  are  certified  by  the 

11 

American  Medical  Record  Association. 

Problems  of  patient  identification  and  record  retrieval  are  chronic  in  many 

hospitals.     Some  hospitals  use  a  "serial"  numbering  system  in  which  a  new  number  is 

assigned  to  the  patient  at  the  beginning  of  each  hospital  stay.     If  the  patient 

returns  to  the  hospital,  he  or  she  has  to  be  matched  accurately  with  past  records 

or  these  cannot  be  used.     A  related  problem  is  that  the  information  in  the  patient's 

record  is  often  poorly  organized.    A  typical  complaint  from  physicians  is  that 

needed  information  from  a  thick  patient  file  cannot  be  easily  extracted.    As  a 

result,  even  when  the  patient's  past  file  can  be  retrieved,  the  information 
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recorded  in  it  is  often  not  used. 

Unlike  the  private  practitioner's  records,  hospital  records  are  subject  to  both 
internal  and  outside  review.     Where  federal  money  is  disbursed  for  health  care,  such 
as  in  Medicaid  or  Medicare,  federal  regulations  require  the  establishment  of 
Professional  Standards  Review  Organizations  (PSRO)  to  determine  that  facilities  and 
professional  services  are  not  being  misused.     Medical  records  play  a  central  role 

IT 

m  such  utilization  reviews. 

The  Joint  Commission  on  Hospital  Accreditation,  a  private  organization  that 

sets  standards  for  hospital  accreditation  requires  that  standard  nomenclature  be 

used  in  diagnoses  and  that  records  contain  "...sufficient  information  to  justify  the 
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diagnosis  and  warrant  the  treatment  and  end  results."        When  the  accreditation 
surveyor  reviews  hospital  facilities  and  procedures,  a  considerable  part  of  his  or 
her  time  is  spent  on  patient  records. 


Local  and  state  agencies  also  conduct  hospital  reviews.     Recently,  the  New  York 

City  Health  Department  condemned  three  voluntary  hospitals  participating  in  the 

Ghetto  Medicine  Program  for  failing  to  maintain  "drug  reaction"  files  necessary  to 

prevent  a  patient  from  being  injured  by  a  bad  combination  of  medication  or  by  drugs 
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to  which  he  or  she  had  had  an  adverse  reaction  in  the  past. 

But  poor  public  hospitals  are  not  the  only  ones  with  record-keeping  problems. 
For  many  hospitals,  the  Joint  Commission's  criteria  are  never  entirely  achieved. 
Among  the  facts  of  everyday  life  in  hospitals  are  physicians'  tsirdiness  in  signing 
drug  orders  and  completing  dischsirge  summaries,  and  hospitals  that  ignore  some 
record-keeping  requirements  because  of  lack  of  staff  and  mounting  costs. '''^ 

In  short,  hospitals  tend  to  allocate  their  limited  resources  to  record-keeping 
tasks  that  meet  immediate  needs:  to  provide  minimum  information  for  patient  care j 
to  file  insurance  claims  quickly  so  that  the  hospital  gets  reimbursed;  to  respond 
to  an  ultimatum  from  the  Joint  Commission  on  Accreditation  that  paurticular  record- 
keeping deficiencies  will  no  longer  be  tolerated. 

Like  private  practitioner's  records,  hospital  records  are  used  for  insurance, 

both  private  and  governmental,  and  as  protection  against  malpractice  claims. 

Hospitals  are  also  subject  to  the  same  public  reporting  requirements  as  private 

physicians:  communicable  disease,  law  enforcement,  child  abuse,  narcotics 
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prescriptions  and  death  certificates.   '     One  widely  used  record  is  the  birth 
certificate,  and  the  duty  to  report  births  falls  largely  on  hospitals. 

Birth  records  serve  both  research  and  legal  functions,  and  for  Americans,  are 
the  closest  this  country  comes  to  an  official  identity  card:  a  birth  certificate  is 
usually  required  upon  entering  elementary  school,  getting  a  work  permit  or  driver's 
license,  a  passport,  entering  the  armed  forces  and  securing  social  security  benefits 
Law  enforcement  agencies  also  regard  tight  birth  certification  procedures  as 
important.     The  Immigration  and  Naturalization  Service,  for  example,  uses  the  birth 
registration  system  as  one  way  to  stem  the  flow  of  illegal  aliens. 

The  U.S.  Standard  Certificate  of  Live  Birth  contains  spaces  for  the  names  and 

addresses  of  the  parents,  the  child's  name,  the  date,  and  the  signatures  of  a 

physician  or  other  witness  and  the  local  registrar  of  records.    This  part  of  the 

1  R 

Birth  Certificate  is  a  matter  of  public  record  in  many  states. 

The  form  also  includes  information  about  the  condition  of  the  mother  prior  to 
childbirth,  complications  which  developed  during  delivery,  and  congenital  or  other 
physical  problems  the  child  was  observed  to  have  at  birth.     There  is  also  a  space 
for  hospital  personnel  to  note  whether  or  not  the  child  is  legitimate.     It  is  not 
always  clear  how  this  decision  is  made.     In  an  informal  investigation  of  this 
question.  Professor  Michael  Baker's  students    found  that  sometimes  it  was  made  by 
doctors,  sometimes  by  nurses.     The  patient  was  not  always  believed,  and  the  nursing 
staff  would  sometimes  check  "out  of  wedlock"  even  when  she  claimed  to  be  married. 
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But  in  large  anonymous  institutions  where  a  woman  may  identify  herself  and  the 

19 

father  as  she  pleases,  an  illegitimate  birth  may  be  recorded  as  legitimate.  ^ 
Psychiatric  Hospital  Records 

The  medical  portion  of  general  hospital  records  may  contain  data  that  relates 

only  to  the  illnesses  being  treated.     But  psychiatric  hospital  records  are  likely 
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to  be  all-inclusive.        As  sociologists  Kai  Erikson  and  Dajiiel  Gilberton  put  iti 

"The  presumption  in  psychiatric  facilities. . .is  that  there  are  no 
areas  in  the  patient's  life  (and  for  that  matter,  no  areas  in  the  lives 
of  his  associates)  that  lie  beyond  the  legitimate  interest  of  the 
institution.     In  this  sense,  the  psychiatric  dossier  is  not  a  brief 
inventory  of  selected  information;  it  is  a  biography,  a  digest  of  one 
person's  character  and  prospects..." 

Erikson  and  Gilberton  go  on  to  note  that  while  the  record  is  all-inclusive  in 
one  sense,  it  is  highly  selective  in  the  sense  that  only  those  items  that  identify 
the  patient  as  being  ill  are  likely  to  be  included.    Thus,  if  the  patient  tells  a 
psychiatrist  of  (a)  his  bedwetting,  (b)  of  his  fear  of  a  teacher,  (c)  of  enjoying 
family  picnics,   (d)  of  his  impulse  to  hit  his  sister  with  a  hammer,   (e)  of  winning 
a  spelling  bee,  (f)  his  terrible  dreajns,  (g)  his  friendship  with  an  unremarkable  boy, 
(h)  his  parents'  arguments,  and  (i)  his  exploits  as  a  young  athlete — items  (a),  (b), 
(d),  (f)  and  (h)  will  no  doubt  be  noted  in  his  recordj    items  (c),  (e),  (g)  and  (i) 
will  likely  be  omitted  as  irrelevant. 

Many  staff  members  may  contribute  to  the  patient's  record — "physiciems. . . 
psychologists,  social  workers,  nurses,  occupational  therapists,  aides,  clerks..." 
The  daily  nursing  notes  may  contain  comments  on  the  patient's  mood,  fantasies,  plajis 
for  the  futvire,  emotional  outbursts,  posture,  and  interaction  with  other  patients 
and  staff. 

In  some  psychiatric  hospitals,  patient  records  are  kept  in  two  different 
categories:  material  like  case  histories  and  certain  test  results  eire  stored  in 
the  central  record  room  or  in  a  locked  closet  off  the  ward,  while  day-to-deiy 
operating  files  such  as  medication  records,  nursing  notes  and  doctors  orders  are 
kept  in  the  ward  where  the  patient  is  receiving  treatment.    The  distribution  of 
these  records  can  be  a  delicate  matter.        On  the  one  hand,  the  patient's  privacy 
is  best  protected  by  keeping  sensitive  material  off  the  wsird,  where  students,  aides 
emd  even  charwomen  roam  largely  at  will.     On  the  other  hand,  partitioning  of 
records  has  the  obvious  effect  of  drawing  status  lines  through  the  hospital  staff 
in  a  manner  that  does  not  serve  to  improve  tempers  or  the  treatment  offered  the 
patient.    There  are  hospitals,  for  example,  where  nurses  do  not  have  access  to 
the  more  sensitive  records,  and  are  dependent  on  physicians  for  the  most  basic 
information. 
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The  amount  of  detail  in  the  "typical"  patient  record  vaxies  considerably  among 
psychiatric  institutions,  especially  between  those  which  provide  active  therapy  and 
the  many  long-term  institutions  that  are  largely  custodial.    Erikson  and  Gilberton 
suggest  that  in  either  case,  most  of  the  material  placed  in  the  file  is  not  read  by 
the  people  to  whom  it  is  addressed;  when  the  records  are  stuffed  with  nursing  reports 
and  social  work  interviews,  clinicians  do  not  have  sufficient  time  to  review  them. 


Nursing  Home  Records 

The  recent  scandals  involving  nursing  homes  licensed  by  the  State  of  New  York 

revealed  financial  exploitation  of  the  inmates,  abysmal  physical  conditions, 

inadequate  nutrition,  and  a  denial  of  medical  care  to  patients  suffering  from 

illnesses.     One  of  the  charges  made  was  that  patients'  records  were  falsified  to 

conceal  stripping  the  patients  of  their  financial  resouces,  ajid  to  create  the 

impression  that  patients  were  receiving  care  that  would  make  the  owners  of  the 
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homes  eligible  for  state  and  federal  reimbursements. 

In  a  study  of  a  private  nursing  home  in  Washington,  D.C.,  where  the  majority  of 

patients  were  referred  by  St.  Elizabeth's  Hospital,  it  was  discovered  that  patients 

were  being  forced  to  work  fifty  to  sixty  hours  a  week  in  the  home's  kitchen  and 

laundry,  or  were  being  hired  out  to  neighborhood  businesses  for  as  little  as  $2.50 

a  week}  that  the  records  were  falsified  to  show  that  they  were  not  working;  or  to 

show  visits  to  doctors  or  hospitals  that  never  took  place;  or  to  show  assignments  to 

rooms  of  one  or  two  inmates,  when  in  fact  all  the  rooms  were  shared  by  four  people 
22 

or  more . 

In  197^,  HEW  set  new  standards  for  nursing  home  care,  including  medical  care, 
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staff -patient  ratios,  nutrition,  minimum  space  per  patient,  etc.        The  regulations 
include  a  Nursing  Home  Patients'  statement  of  rights,  and  among  the  rights 
guaranteed  is  "confidential  treatment  of  (the  patient's)  personal  and  medical 
records"  and  the  right  to  "approve  or  refuse  their  release  to  any  individual  outside 
the  facility  except  in  case  of  his  transfer  to  another  health  care  institution,  or 
as  required  by  law  or  third-party  payment  contract." 

The  record-keeping  problems  in  many  nursing  homes  do  not  usually  involve 
breaches  of  confidentiality.     The  more  frequent  complaint  is  lack  of  supervision  of 
the  institution.     The  main  emphasis  of  the  new  HEW  regulations  is  setting  standards 
for  care  and  monitoring  exploitation  of  the  patients. 
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Records  in  Other  Health  Caxe  Settings 


Some  public  health  clinics  have  as  complete  information  about  a  patient  as  the 
general  hospital.        Pre-natal  clinics,  for  mstsince,  may  do  a  complete  medical 
work-up.     But  more  often  the  scope  of  the  records  reflects  the  limited  medical  care 
provided — vaccinations,  treatment  for  minor  illnesses  and  Injuries,  etc.  Where 
V.D.  treatment  or  birth  control  information  is  provided,  the  records  generated, 
while  similarly  narrow  in  scope,  may  be  extremely  sensitive. 

Dentists  usually  keep  little  information  beyond  a  history  of  the  work  performed 
and  x-rays.     These  are  sometimes  used  as  identification  for  disaster  victims  and  in 
criminal  cases.     Dental  surgeons  maintain  a  greater  range  of  patient  data  because 
they  often  administer  ajiesthetics  and  prescribe  medications. 

Optometrists  and  podiatrists  keep  only  the  patient  data  relevant  to  their 
26 

specific  tasks.        Local  pharmacists  cam  get  a  pretty  clear  picture  of  their 

customer's  medical  problems  from  the  medications  prescribed  and  the  specialties  of 

the  physicians  writing  the  prescriptions.     In  most  pharmacies,  prescriptions  are 

filed  in  sequence,  each  under  a  different  number.     By  law,  prescriptions  for 

narcotics  axe  filed  separately  and  the  pharmacist  must  account  for  his  supply  of 
27 

narcotics.        In  many  states,  the  funeral  director  has  access  to  medical  information 

because  he  is  responsible  for  filling  in  identification  information  and  getting  the 
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physician  to  record  the  cause  of  death. 
Citizen    Rights  Issues  and  the  Law 
1 .  Privacy 

The  information  gathering  process  in  a  hospital  is  just  one  factor  out  of  many 
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which  tends  to  strip  patients,  both  figuratively  and  literally.        A  patient  is 
constantly  being  physically  exposed  during  medical  exsiminations,  by  the  backless 
hospital  gown,  by  the  performance  of  bodily  functions  in  front  of  ward-mates  and 
staff;  by  the  invasion  of  the  ward  by  other  patients'  visitors,  gray  ladies,  clergy, 
administrative  workers,  nurses'  aides,  cleaning  people  and  others  whose  comings  and 
goings  the  patient  cannot  control.    Whether  a  particular  hospital  staff  treats  its 
patients  with  tact  and  sensitivity,  or  with   indifference       or  callousness,  the 
stripping  away  of  the  patient's  reserve  is  a  dominant  theme  of  hospital  life.  The 
hospital  staff  may  view  this  process  matter-of-f actly j  the  patients  may  not,  as  the 
remarks  of  one  patient  illustrates 

"I  saw  what  happened  to  one  of  my  roommates. . .She  had  plastic  surgery 
of  the  vagina  and  it  seemed  like  every  new  nurse  and  everybody  on  duty  wanted 
to  see... It  seemed  like  just  a  case  of  out-and-out  curiosity .. .She  was 
feeling  very  sensitive  and  not  really  wanting  to  advertise  the  fact.  And 
now  everybody  in  the  world  is  going  to  look..." 

A  hospital,  then,  is  not  a  place  likely  to  foster  an  atmosphere  of  patient 
privacy,  and  the  collection  of  intimate  medical  information  must  be  seen  in  this 
context. 
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Within  the  hospital  framework,  it  is  almost  universally  accepted  that  full 
disclosure  by  the  patient  to  the  health  care  provider  is  necessary,  often  crucial 
for  accurate  diagnosis  and  effective  treatment,  and  few  objections  axe  raised  about 
the  circulation  of  patient  information  among  medical  personnel  directly  involved  in 
patient  care . 

However,  tv/o  questions  closely  related  to  privacy  sometimes  do  arise.     That  is, 
what  should  be  recorded  and  how  long  it  should  be  kept.     One  such  case  involved 
several  San  Francisco  women  who  sought  to  have  hospitals  return  "psychiatric  need" 
letters  written  by  their  doctors  to  justify  abortions.^      Before  the  1972  Supreme 
Court  ruling  that  women  have  a  constitutional  right  to  an  abortion,  the  only  way 
they  could  secure  them  in  many  states  was  to  claim  a  psychiatric  condition  that 
would  be  exacerbated  by  pregnancy.     Many  doctors  exaggerated  the  emotional  distress 
felt  by  a  pregnant  patient  to  justify  an  abortion  in  a  particular  state  or  for  a 
particular  hospital  review  committee. 

A  Sain  Francisco  woman  had  secured  two  abortions  at  a  Kaiser-Permanente  facility, 

one  of  which  had  required  an  "emotional  distress"  letter.     She  told  the  Kaiser 

authorities  that  she  wanted  it  back,  v;ith  no  copy  kept  by  the  hospital,  because  if 

she  applied  for  life  insurance,  certain  government  jobs»  licensing,  etc.,  she  would 

have  to  sign  releases  waiving  confidentiality  of  her  records  and  she  could  be  harmed 
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by  the  presence  of  that  letter  m  her  file.-^ 

Neither  she  nor  any  of  the  other  women  succeeded  in  getting  the  stigmatizing 
letters  back.     One  hospital  justified  itself  by  citing  a  seven  year  retention-of- 
records  law.     Another  said  it  had  to  keep  them  in  case  of  legal  actions  that  might 
somehow  involve  the  abortion  procedure.    Another  said  it  would  be  willing  to  destroy 
the  letter  but  would  not  give  the  patient  the  original.    As  more  and  more  permanent 
files  are  created,  the  question  will  arise  with  increasing  frequency:     When  can 
patients  have  records  that  axe  alleged  to  be  inaccurate,  incomplete,  biased  or  based 
on  outmoded  social  or  ethical  standards  expunged  from  their  files,  and  by  what 
procedures? 

2 ,  Conf identialit?/ 

The  doctrine  of  confidentiality  has  its  roots  in  earliest  medicine.     It  was 
promulgated  to  reassure  the  patient  that  the  information  volunteered  would  go  no 
further  than  the  health  professional  to  whom  it  was  confided.     The  Hippocratic  Oath 
first  set  out  the  duty  of  confidentiality  as  follows: 

"Whatsoever  things  I  see  or  hear  concerning  the  life  of  man,  in 
any  attendance  on  the  sick  or  even  apart  therefrom  which  ought  not  to 
be  noised  about,  I  will  keep  silent  thereon,  counting  such  things  to 
be  professional  secrets." 

The  modern  interpretation  of  this  oath  is  contained  in  the  American  Medical 
Association's  Principles  of  Ethics: 
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"A  physician  may  not  reveal  the  confidences  entrusted  to  him  in  the 
course  of  medical  attendance,  or  the  deficiencies  he  may  observe  in  the 
character  of  patients,  unless  he  is  required  to  do  so  by  law  or  unless  it 
becomes  necessary  in  order  to  protect  the  welfare  of  the  individual  or 
the  community." 

The  relationship  of  candid  disclosure  to  confidentiality  has  been  set  forth 
in  a  recent  judicial  opinion  as  follows: 

"Since  the  layman  is  unfamiliar  with  the  road  to  recovery,  he 
cannot  sift  the  circumstances  of  his  life  and  habits  to  determine  what 
is  information  pertinent  to  his  health. 

"As  a  consequence,  he  must  disclose  all  information  in  his 
consultation  with  his  doctor  -  even  that  which  is  embarrassing, 
disgraceful  or  incriminating.     To  promote  full  disclosure,  the  medical 
profession  extends  the  promise  of  secrecy. . .The  candor  which  this 
promise  elicits  is  necessary  to  the  effective  pursuit  of  health?  there 
can  be  no  reticence,  no  reservation,  no  reluctance  when  patients  discuss 
their  problems  with  their  doctors. "32 

Thus  the  need  to  maintain  confidentiality  is  widely  recognized  as  an  ethical 
obligation,  as  part  of  the  implied  contract  in  the  doctor-patient  relationship. 

The  patient's  right  to  confidentiality  is  popularly  portrayed  as  being  solidly 
entrenched.     Medical  dramas  on  television  often  stress  the  inviolability  of  the 
patient's  confidences  to  the  doctor.     In  police-courtroom  dramas  like  "Perry  Mason," 
only  the  medical  exajniner,  a  public  official,  testifies  on  medical  matters;  private 
physicians,   hardly  ever,  in  soap  operas,  in  which  the  major  action  shuttles  between 
the  operating  room  and  the  courtroom,  physicians  are  often  shown  agonizing  because 
they  are  forbidden  by  medical  ethics  to  reveal  some  crucial  fact  which  would  prevent 
a  miscarriage  of  justice. 

But  in  real  life,  the  doctrine  of  confidentiality  of  medical  records  often  is 
forced  to  give  way  to  other  public  interests — medical,  legal  or  social.     In  balancing 
confidentiality  against  these  competing  or  conflicting  interests,  confidentiality 
under  AmericaJi  law  does  not  begin  with  an  inherent  Constitutional  primacy.  Free 
speech,  by  contrast,  is  specifically  protected  by  the  Constitution,  and  courts  have 
ruled  that  it  cannot  be  abrogated  except  for  some  "compelling  governmental  necessity," 
with  the  burden  on  the  government  to  prove  that  its  "necessity"  is  indeed 
"compelling." 

Physic iaJi-patient  confidentiality  enjoys  no  such  sweeping  protection.  Thirty- 
eight  states  have  laws  that  "privilege"' the  patient's  communication  to  the  physicians, 
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but  these  laws  have  majiy  exceptions  and  "waiver"  provisions.        A  brief  explanation 
of  the  doctrine  of  privilege  may  be  helpful  to  understanding  what  aspects  of 
confidentiality  these  laws  do  and  do  not  protect. 
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A  communication  is  said  to  be  privileged  if  the  person  to  whom  the  information 
is  given  is  forbidden  by  law  from  disclosing  the  information  in  a  courtroom  without 
the  consent  of  the  person  who  provided  it.     So  privilege  applies  only  to  judicial 
proceedings}  it  is  a  legal  rule  of  evidence.    Also  the  privilege  belongs  only  to 
the  patient,  not  to  the  physician  or  other  health-care  provider. 

Unlike  the  attorney-client  privilege,  the  physician-patient  privilege  is  not 
recognized  in  the  common  law  (those  laws  made  by  judicial  decisions  and  not  by 
legislative  enactment  of  statutes).     It  therefore  exists  only  in  those  38  states 
which  have  passed  a  statute  establishing  it. 

Perhaps  the  best  way  of  understajnding  the  limitations  of  the  physiciain-patient 
privilege  is  to  list  some  of  the  circumstances  under  which  physicians  or  other 
health  professionals  are  (a)  permitted  to  reveal  medical  information  about  their 
patients;  or  (b)  affirmatively  required  to  reveal  such  informations 

A.  Public  Reporting  Laws:    Almost  all  states  have  laws  requiring  physicians 

  3^^ 

to  report  a  wide  variety  of  conditions  to  public  authorities.        There  are  four 

categories  of  reporting  statutes: 

(I)  Birth  smd  death  certificates.    As  already  noted,  the  birth  form  calls  for 
considerable  information  about  the  parents.     Some  states  also  require  the  filing  of 
a  certificate  for  a  fetal    "birth"  either  by  miscarriage  or  abortion.     One  such 
statute  was  recently  declared  unconstitutional  in  New  York,  as  an  invasion  of 
privacy. 

If  death  is  accidental  or  sudden,  or  if  foul  play  is  suspected,  the  medical 
examiner  or  coroner  is  required  to  do  an  autopsy  and  file  a  report  of  his  findings 
with  the  district  attorney.     These  reporting  statutes  are  almost  universally  complied 
with,  and  failure  to  do  so  is  generally  a  misdemeanor  punishable  by  both  fine  and 
imprisonment . 

(II)  Infectious,  contagious  or  communicable  diseases.     The  California  statute, 
for  example,  lists:  "Cholera,  plague,  yellow  fever,  malaria,  leprosy,  diphtheria, 
scarlet  fever,  smallpox,  typhus,  typhoid,  paratyphoid,  anthrax,  glanders  meningitis, 
tuberculosis, pneumonia,  dysentery,  erysipelas,  hookworm,  trachoma,  dengue,  tetanus, 
measles,  German  measles,  chickenpox,  whooping  cough,  mumps,  pellagra,  beriberi. 
Rocky  Mountain  spotted  fever,  syphilis,     gonococcus,  rabies  or  poliomyelitis."  In 
addition,  the  California  statute  requires  reporting  to  the  Motor  Vehicle  Bureau 

of  any  disease  that  might  cause  "lapse  of  consciousness"  (e.g.  epilepsy). 

(III)  Child  abuse.     Reporting  generally  comes  from  the  emergency  rooms  of  large 
city  hospitals.     Some  states  have  passed  legislation  to  set  up  registries  of 
potential  child  abusers  in  order  to  systematize  reporting. 


21 


(IV)  Wound  Reports.     "Bullet  wound,  gunshot  wound,  powder  burn,  or  any  other 
injury  arising  from  or  caused  by  the  discharge  of  a  gun  or  firearm,  and  every  case 
of  a  wound  which  is  likely  to... result  in  death  and  is  actually  or  apparently 
inflicted  by  a  knife,  icepick  or  other  sharp  or  pointed  instrument." 

These  reporting  statutes  are  examples  of  how  legislatures  have  specifically 
codified  exceptions  to  the  physic iaji-patient  privilege.     A  physician  could  probably 
also  notify  a  non-government  agency,  such  as  an  airline,  that  a  patient-pilot 
had  experienced  blackouts  under  the  same  theory.     The  reason  for  this  exception  is 
that  at  some  point,  the  competing  interests  of  society  outweigh  both  society's 
and  the  individual's  interests  in  maintaining  medical  confidentiality. 

B.  Consent  of  the  Patient;      If  a  patient  brings  a  lawsuit  against  a  physician 
or  hospital  for  malpractice,  he/she  will  probably  want  to  bring  his/her  medical 
records  into  court  to  support  the  claim  for  damages. ^-^    The  patient  may  wish  to 
bring  medical  records  into  court  when  suing  a  third    party  for  damages  in  a  personal 
injury  case  to  document  the  extent  of  the  injuries  suffered.     No  breach  of 
confidentiality  is  involved  in  such  cases,  since  the  "privilege"  belongs  to  the 
patient.     In  one  case,  for  example,  a  psychiatrist  who  attempted  to  assert  the 
physician-patient  privilege  over  the  objections  of  his  patient,  to  protect  the 
patient's  best  interest  and  safeguard  psychiatric  privacy  in  general  was  sent  to 
jail  in  California  for  contempt  of  court. -^^ 

Often,  the  patient's  consent  to  release  medical  information  is  not  at  all 
clear-cut, 

(I)  "Implied  Consent".     In  many  hospitals,  people  not  involved  in  the  patient's 
care  may  have  access  to  the  patient's  record,  including  nurses  on  all  three  shifts, 
medical  students,  interns  and  residents,  financial  workers,  ward  secretaries,  social 
workers  and  researchers  of  many  kinds.        All  of  this  takes  place  on  the  "implied 
consent"  of  the  patient  -  that  is,  his/her  very  presence  in  the  hospital  is  taken 

to  imply  consent  for  widespread  in-house  access}  this  usually  occurs  without  the 
patient  being  aware  of  it.-^'^ 

(II)  General  or  "Blanket"  Consent.     Upon  entering  a  hospital,  a  patient  may 
be  asked  to  sign  an  authorization  which  says  essentially  that  the  hospital  may 
release  medical  information  about  the  patient  to  anyone  it  thinks  should  have  it.-^^ 
This  will  include  private  or  government  insurance  payers,  utilization  review 
committees,  and  others  monitoring  the ■ quality  of  patient  care  or  cost.     Thus,  the 
need  to  assure  payment  for  medical  care  and  to  assure  the  quality  of  that  care  take 
precedence  over  the  doctrine  of  confidentiality.     Generally,  no  restriction  is 
placed  on  the  amount  or  the  relevance  of  the  material  that  may  be  released  or  the 
use  which  many  of  these  third  parties  may  make  of  this  information. 
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(III)  Partial  Consent.     Situations  often  arise  in  which  some  courts  have 

found  that  the  patient  has  "waived"  his  right  to  confidentiality.     In  one  case, 

a  civilian  employee  of  the  Air  Force  asked  his  doctor  to  make  a  partial  disclosure 
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of  his  medical  record  to  his  employer  to  explain  his  absenteeism.  ^    The  court 
held  that  because  of  this  consent  to  disclose  part  of  the  record,  the  patient  was 
"estopped"  from^ complaining  when  his  physician  made  full  disclosure,  including  his 
alcoholism. 

In  another  case,  a  court  held  that  an  application  for  life  insurance  was  a 
waiver  of  confidentiality.^^    In  this  case,  the  pediatrician  of  an  infant  informed 
a  life  insurance  compajiy  of  a  congenital  heart  defect  of  which  he  had  not  informed 
the  child's  parents. 

(IV)  Consent  for  Minors.     Special  problems  are  involved  with  health  care  for 
minors.     Generally^  parental  consent  is  required  for  both  the  treatment  of  a  minor 
and  for  the  release  of  the  child's  medical  records.     However  49  states  (the 
exception  is  Wisconsin)  now  allow  minor  youths  to  receive  venereal  disease  treatment 
without  the  consent  of  their  parents  and  in  strict  confidentiality.     Many  states 
have  also  lowered  the  age  of  consent  either  for  all  health  care  or  for  specific 
categories  of  treatment,  such  as  pregnancy  and  pregnsmcy  prevention. 


C.  Best  Interests  of  the  Patient t     Some  state  laws  make  an  exception  to  the 
physician-patient  privilege  to  permit  disclosure  to  third  parties  in  "the 
best  interests  of  the  patient."    The  New  Jersey  Statute,  for  example,  states  that: 

"  [NjDthing  in  this  section  shall  preclude  disclosure  upon  proper 

inquiry,  of  information  as  to  a  patient's  current  medical  condition  to 

any  relative  or  friend... if  it  appeaxs  that  the  information  is  to  be 
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used  directly  or  indirectly  for  the  benefit  of  the  patient." 

Courts,  too,  will  give  physicians  wide  latitude  in  making  disclosures  that 
physiciajis  believe  sire  in  their  patients'  best  interests.     A  court  found  it 
permissible  for  a  mental  institution  to  which  parents  had  taken  their  child  for 
help  to  report  to  her  school  that  she  was  "feeble-minded"  and  to  predict  that  "at 


*  Adele  D,  Hofmann,  M.D.,   "Confidentiality  and  the  Health  Care  Records  of 

Children  and  Minor  Youth,"  Paper  prepared  for  Conference  on  the  Confidentiality 
of  Health  Records,  Key  Biscayne,  Florida,  November  6-9,  197^,  p. 5. 
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the  time  she  is  about  sixteen,  she  should  have  progressed  to  about  the  fourth  grade 
level."       Although  there  has  been  little  judicial  explication  of  this  exception, 
one  can  deduce  that  telling  a  spouse  of  a  patient's  heaurt  condition,  or  telling  aui 
employer  of  a  roofer  that  the  roofer  is  subject  to  blackouts  and  would  be 
endangering  his  life  in  this  trade,  would  probably  qualify. 

D.  Supervening  Interests  of  Society;  The  leading  case  here  is  Simonsen  v. 
Swenson,  decided  by  the  Nebraska  Supreme  Court  in  1920.  ^    A  man  who  was  visiting  a 
small  town  was  seen  by  a  physician,  who  was  also  the  physician  for  the  hotel  where 
the  patient  was  staying.     The  physician  diagnosed  syphilis  and  advised  the  patient 
to  "get  out  of  town"  or  he  would  tell  the  hotel.     When  the  patient  refused  to  leave, 
the  doctor  notified  the  landlady  who  disinfected  his  room  and  put  his  belongings  in 
the  hall.    The  court  decided  that  the  doctor  had  the  right  to  reveal  as  much 
information  about  a  contagious  disease  as  was  necessary  for  others  to  take 
precautions  against  becoming  infected,  and  that  his  actions  were  justified. 

In  a  lawsuit  filed  in  197^.  a  doctor  informed  his  patient's  fiance  that  she 
had  syphilis,  and  as  a  result,  the  wedding  was  cancelled.        In  this  case,  however, 
the  doctor  had  misread  the  premarital  blood  test,  and  the  patient  is  suing  him  for 
$500,000. 

The  California  Supreme  Court  has  recently  extended  the  "supervening  interests 
of  society"  exception  to  the  psychotherapist  whose  patient  threatens  bodily  harm 
to  a  named  individual.  The  court  went  one  step  further,  however,  in  finding  an 

affirmative  duty  on  the  part  of  the  therapist  to  wajm  the  named  "victim." 

E.  The  Public's  Right  to  Know.*      This  exception  applies  mainly  to  the  press, 
and  press  interest  in  medical  records  is  usually  related  to  individuals  v,'ho  are 
newsworthy,  either  because  of  their  prominence  (actor,  politicism,  sports  figure) 

or  because  they  are  part  of  a  current  story  (accused  criminal,  birth  of  quintuplets) 
Generally,  hospitals  will  give  out  only  minimal  information  about  a  patient's 
condition  unless  they  have  express  permission  from  the  patient  to  release  more,  as 
when  a  politician  authorizes  the  release  of  detailed  information  to  avoid  damaging 
public  speculation.     Police  spokesmen  sometimes  release  information  about  criminal 
suspects  against  their  wishes. 

Two  leading  legal  commentators,  J.R.  Waltz  ajid  F.E.  Inbau,  writing  in  1971i 
argue  that  s  r 

"The  fact  that  the  patient  is  not  a   'private'  person  but  rather  a 
celebrity  who  customarily  feeds  on  publicity .. .will  probably  be  considered 
of  no  consequence  where  intimate  medical  data,  covered  by  explicit  legal 
and  ethical  requirements  of  confidentiality  are  involved.     The  fact  that 
medical  data  are  newsworthy  or  will  advance  science  is  likewise  not 
controlling. "  46 
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The  authors  state  that  one  exception  to  this  might  be  the  condition  of  the 
President  since  the  public  has  a  right  to  this  information.     After  the 
hospitalization  of  former  Presidents  Truman,  Eisenhower  and  Nixon,  one  might  include 
former  presidents  in  this  category,  although  public  interest  in  their  conditions  was 
certainly  not  as  great  as  when  they  held  office. 

A  separate  question  is  raised  by  the  release  of  medical  information  obtained 

in  a  questionable  or  illegal  manner,  as  in  the  case  of  Senator  Thomas  Eagleton  and 
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more  recently,  Manhattan  District  Attorney  Frank  Hogan.        The  New  York  Post 
revealed  that  Hogaji,  up  for  re-election,  had  been  hospitalized  for  a  stroke  and  lung 
cancer,  although  his  office  said  it  was  for  fatigue.     The  Post  quoted  directly 
from  medical  reports  to  support  their  claim,  and  defended  the  use  of  stolen  hospital 
records  by  saying  the  electorate  had  a  right  to  know  the  facts. 

In  amswer  to  the  question:    Does  it  matter  how  the  press  obtains  private 
medical  information?  -  the  case  law  seems  to  indicate  that  so  long  as  the  press 
did  not  themselves  commit  a  crime  in  obtaining  the  information,  they  can  publish 
it  with  impixnity  if  there  is  a  legitimate  public  interest  in  it.     The  press  will 
not  be  held  as  accessories  for  receiving  stolen  goods  because  the  courts  will 
generally  find  that  what  they  received  was  "information,"  the  actual  documents 
having  been  copied  and  replaced. 


F.  The  Judicial  Process!    As  noted,  in  the  absence  of  a  state  statute,  the 
courts  do  not  recognize  a  physician-patient  privilege.    The  common  law  principle 
is  that  the  courtroom  is  an  arena  for  discovery  of  the  truth,  and  confidential 
communications  should  not  be  beyond  the  court's  reach.     The  late  Dean  Wigmore , 
perhaps  the  leading  legal  expert  on  evidence,  argued  that  the  privilege  frustrated 
justice  by  denying  truthful  information  to  the  courts;     that  most  information 
communicated  to  a  physician  is  not  intended  to  be  held  strictly  confidential  since 
most  of  one's  ailments  are  both  apparent  and  openly  discussed;  and  that  even  if  it 
were  meant  to  be  confidential,  it  would  be  disclosed  to  the  physiciaui  even  if  no 
privilege  existed. 

Retention  of  the  privilege  was  the  most  controversial  item  in  the  new  Federal 

Rules  of  Evidence  which  became  law  in  1975.     Initial  versions  eliminated  the 

privilege  entirely.     The  final  version  px'ovides  that  the  privilege  shall  "be 

governed  by  the  principles  of  the  common  law  as  they  may  be  interpreted  by  the 

courts  of  the  United  States  in  the  light  of  reason  and  experience."    Where,  however, 

state  law  governs  a  case,  the  privilege  shall  be  "determined  in  accordance  with 
4-9 

state  law."  ^  A  special  privilege  was  retained,  however,  for  communications  between 
psychotherapist  and  patient. 
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Where  courts  have  found  a  breach  of  patient  confidentiality,  the  cases  have 
generally  not  turned  on  that  breach  alone.     The  key  element  has  usually  been 
publication,  generally  accompanied  by  a  photograph  of  the  patient,  that  could  be 
construed  as  commercial  exploitation  or  advertising.     In  such  cases,  sometimes  the 
suit  is  against  the  publisher,  and  not  the  physiciam  or  other  health  care  provider. 
Some  illustrations: 


In  1939,  Time  Magazine  published  the  story  of  a  young  woman  receiving  treatment 
for  uncontrollable  gluttony.     She  sued  the  magazine  and  was  awarded  $1,500.-^^  A 
hospital  was  sued  for  permitting  newspaper  publication  of  an  infant  bom    with  the 
heart  outside  the  body.^''"    A  newspaper  syndicate  was  sued  for  publication  of  an 
x-ray  disclosing  a  hemostat  that  had  been  in  the  patient's  abdomen  for  four  years. 
Physicians  were  sued  for  filming  a  Caesarean  section  and  using  the  film  as  part  of 
a  documentary.-^-^    A  medical  journal  was  sued  for  publishing  a  physician's  "before 
and  after"  pictures  to  illustrate  treatment  of  "saddle  nose".^ 


Other  cases  indicate  that  publication  is  not  always  necessary.     In  Home  v. 
Patton  for  example,  a  case  involving  disclosure  of  medical  information  to  a  patient's 
employer,  an  Alabama  court  in  1973  found  that:     "unauthorized  disclosure  of  intimate 
details  of  a  patient's  health  may  amount  to  unwarranted  publicization  of  one's 
private  af fairs ...  such  as  to  cause  outrage,  mental  suffering,  shame  or  humiliation 
to  a  person  of  ordinary  sensibilities .  "-^-^ 


Any  discussion  of  the  law  and  confidentiality  must  recognize  that  the  law  is 
very  sparse.     In  the  first  place,  few  patients  bring  such  lawsuits  because  they 
usually  have  no  way  of  knowing  who  has  had  access  to  their  records  ajnd  for  what 
purpose.    Even  when  patients  learn  of  breaches  of  confidentiality,  they  may  decide 
they  camot  afford  the  time  or  money  for  litigation.     Most  important,  a  lawsuit 
means  a  public  trial  which  only  serves  to  publish  the  very  information  they  wish 
to  remain  confidential. 


A  further  deterrent  is  that  the  prospects  of  such  litigation  are  not 
encouraging.    While  patients  may  sue  for  invasion  of  privacy  or  breach  of 
confidentiality,  or  for  defamation  if  the  information  released  about  them  is  false, 
the  fact  is  that  there  is  no  reported  U.S.  case  in  which  a  physician  or  hospital 
has  ever  had  to  pay  money  damages  for  breach  of  confidentiality.^      (As  noted 
earlier,  some  publications  have  paid  damages.) 


Eliminating  Exceptions  by  Statute: 


One  way  to  increase  the  confidentiality  of  medical  records  is  to  protect  them 

specifically  by  statute.    An  example  is  the  New  York  statute  drafted  by  Professor 

William  J.  Curran  to  protect  the  Multi-State  Information  System  for  Psychiatric 
67 

Patient  Records.-^'     The  statute  specifically  declares  that  these  records  are 
"confidential  and  not  subject  to  examination  in  the  courts  or  by  agencies  of  this 
state ... (and)  are  not  public  records. . .and  not  subject  to  subpoena  in  any  court  or 
before  any  tribunal  or  administrative  agency." 
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On  the  Federal  level,  the  Comprehensive  Drug  Abuse  Prevention  and  Control  Act 
of  1970  provides  thats 

"The  Secretary  (of  HEW)  may  authorize  persons  engaged  in  research 
on  the  use  and  effect  of  drugs  to  protect  the  privacy  of  individuals  who 
are  the  subject  of  such  research  by  withholding  from  all  persons  not 
connected  with  the  conduct  of  such  research  the  names  or  other  identifying 
characteristics  of  such  individuals.     Persons  so  authorized  to  protect 
the  privacy  of  such  individuals  may  not  be  compelled  in  any  Federal,  State 
or  local  civil,  criminal,  administrative,  legislative  or  other  proceedings 
to  identify  such  individuals."  58 

In  the  case  of  People  vs.  Newman  in  1973 1  Wew  York's  highest  court  reversed  a 
lower  court  ruling  that  the  Director  of  a  Methadone  Clinic,  protected  by  the  Federal 
statute,  had  to  turn  over  photographs  of  black  male  patients  between  the  ages  of 
21  and  35  to  the  police. The  case  arose  when  the  witness  to  a  killing  told  police 
she  believed  she  had  previously  seen  the  killer  in  the  waiting  room  of  the  clinic. 

Thus,  a  properly  drafted  statute  can  eliminate  some  of  the  exceptions  to  the 
doctrines  of  privilege  and  confidentiality. 

3.  Patient  Access  to  Medical  Records 

The  movement  to  promote  policies  and  laws  to  give  patients  access  to  their 
medical  records  parallels  attempts  by  parents  and  students  to  get  access  to  school 
records  and  of  consumers  to  get  access  to  credit  bureau  records.    All  of  these  are 

part  of  a  growing  citizen  movement  to  affirm  individual  self-determination  and  to 
place  limits  on  the  power  of  institutions  to  determine  important  aspects  of  people's 
lives  without  due  process  oriented  procedures. 

As  to  medical  records,  when  these  were  in  fact  used  only  by  the  physician  or 
the  hospital,  it  may  have  been  only  curiosity  when  patients  asked  to  know  their 
contents.     But  now  that  medical  records  are  widely  shared  with  health  insurance 
companies,  government  payers,  law  enforcement  agencies,  welfare  departments,  schools 
researchers,  credit  grantors,  and  employers,  it  is  often  crucial  for  the  patient  to 
know  what  is  being  recorded,  and  to  correct  inaccuracies  that  may  affect  education, 
career  advancement  or  government  benefits. 

This  drive  for  patient  access  runs  head-on  into  the  traditional  view  of  health 
professionals  that  they  alone  should  decide  what  patients  should  know  about  their 
records,  that  access  might  lead  patients  to  become  confused  or  anxious,  and  that 
this  undermines  good  medical  care.    While  there  are  a  few  dissenters  in  the  medical 
profession  who  believe  that  patient  access  to  medical  records  is  good  medicine, 
the  overwhelming  majority  of  health  professionals  still  oppose  it.     The  position 
of  the  American  Medical  Association  summarizes  the  main  professional  viewt 
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"It  is  our  position  that  the  right  of  a  patient  to  medical  information 
from  his  physician  is  based  upon  the  fiduciary  relationship  which  imposes 
a  duty  to  act  in  the  best  interest  of  the  patient.     It  would  be  a  violation 
of  that  duty  to  provide  information  which  would  be  harmful  to  the  best 
interest  of  the  patient  as  a  matter  of  sound  medical  judgment.     It  is 
our  position  that  a  physician  has  both  a  right  ajid  a  duty  to  withhold 
information  in  circumstajices  in  which  he  reasonably  determines  that  it 
would  not  be  in  the  best  interest  of  the  patient. "60 


Between  the  adamant  position  of  most  physicians  and  the  equally  adamant 
position  of  consumer  advocates  is  a  compromise  position  which  calls  for  partial 
access.     Dr.  Simon  Auster,  Director  of  the  Fairf  six -Falls  Church  Mental  Health  Service 
Board,  commenting  on  a  proposed  Virginia  access-confidentiality  statute,  suggests 
that  patients  be  given  access  to  any  part  of  their  record  that  may  be  disseminated 
to  others  so  that  patients  would  have  "eui  opportunity  in  advance  to  confirm  its 
accuracy  or  to  prevent  its  release."    At  the  same  time,  he  would  keep  from  the 
patient  those  parts  of  the  record  that  reflect  the  physician's  "thinking  out  loud" 
or  subjective  impressions.^^ 


Overview  of  the  Law  on  Access ; 

A  few  states  have  special  access  statutes  which  enable  patients  treated  in 

hospitals  to  view  and  copy  their  medical  records.   (Some  statutes  limit  this  right 

to  the  patient's  attorney  or  authorized  representative.)     Perhaps  the  most  liberal 

of  these  is  the  Massachusetts  statute  which  gives  patients  an  absolute  right  of 
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access  both  during  their  hospital  stay  and  after  discharge. 


The  Massachusetts  statute,  enacted  in  19^5 f  was  sponsored  by  Edward  R. 
Butterworth,  an  attorney,  who  had  difficulty  getting  hospital  records  for  clients 
involved  in  cases  in  which  the  records  were  needed.     Mr.  Butterworth,  however, 
has  recently  been  forced  to  sue  a  hospital  that  refused  to  release  patient  records 
even  in  the  face  of  the  statute.     His  experience  is  not  unique.     A  1973  study  of 
the  effect  of  this  statute  in  the  Boston  area  by  the  Center  for  Law  and  Health 
Sciences  of  Boston  University  Law  School  revealed  that  9  out  of  10  major  hospitals 
denied  patient  requests  for  information.^^    Only  one  followed  the  statutory 
language.     A  typical  response  came  from  the  Director  of  Boston's  Beth  Israel 
Hospital:     "We  would  prefer  to  send  the  chart  to  a  physician  so  that  he  or  she 
might  interpret  the  information  to  the  patient...  in  order  to  make  a  reasonable 
judgment  on  the  request  that  the  patient  directly  receive  the  chart."    A  1975 
survey  by  the  Massachusetts  Public  Interest  Research  Group  found  that  only  3  out 
of  28  hospitals  examined  were  in  compliance  with  the  access  law. 

Where  there  is  no  special  access  statute,  the  only  way  a  patient  may  be  certain 
of  obtaining  information  from  his  medical  record  is  to  file  a  lawsuit  against  the 
doctor  or  hospital  involved  (usually  alleging  malpractice)  and  obtaining  the  record 
through  court-sanctioned  discovery.     This  fact  was  noted  by  the  Secretary's 
Commission  on  Medical  Malpractice  (HEW)  in  1973  which  found  that  "the  unavailability 
of  medical  records  without  resort  to  litigation  creates  needless  expense  and 
increases  the  incidence  of  unnecessary  malpractice  litigation. "^^ 
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Health  professionals  frequently  deny  patient  access  to  medical  records  on  the 
ground  that  they  are  the  property  of  the  physician  or  hospital.     However,  the  few 
appellate  court  decisions  have  almost  uniformly  held  that  while  the  physician  or 
hospital  may  own  the  paper  on  which  the  record  is  written,  the  interest  of  the 
patient  in  the  information  is  so  vital  that  he  does  have  a  right  to  a  copy  of  it. 

In  one  case  where  am  insursmce  company  sought  access  with  the  patient's 
authorization,  the  court  said  the  hospital  is  only  the  custodian  of  the  record,  and 
the  patient  has  a  property  right  in  it  sufficient  to  allow  him  to  copy  it  without 
having  to  sue.^^    A  New  York  Court  held  that  a  hospital  cannot  withhold  a  patient's 
medical  record  for  the  purpose  of  concealing  the  identity  of  a  physician  who  may 
have  committed  malpractice  on  the  patient.^'''    In  a  District  of  Columbia  federal  case, 
a  dispensary  and  a  physician  were  ordered  to  hand  over  medical  records  to  a 
surviving  son  even  though  the  statute  of  limitations  for  a  wrongful  death  action 
had  expired.        The  Court  he Ids     "We  are  unwilling  to  hold  that  one  to  whom  a  duty 
to  disclose  medical  data  is  already  owed  is  compelled. .. to  engage  in  legal 
proceedings  to  attain  a  loftier  status." 

In  the  area  of  mental  health,  however,  the  case  law  is  not  unanimous.     In  a 

Texas  case,  in  196^  a  patient  was  able  to  obtain  access  to  his  mental  institution 

records  on  the  ground  that  the  institution  was  "public"  and  the  records  were  open 
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to  inspection  by  patients.        A  New  Jersey  court  found  that  the  state  access 
statute  applied  to  eight  mental  patients  who  desired  access  to  help  challenge  their 
involuntary  commitments  and  the  quality  of  the  care  they  received.''^ 

But  in  a  recent  Federal  District  case  in  New  York,  the  court  decided  against 
a  patient's  access  on  the  narrow  ground  that "neither  the  statutory,  administrative 
nor  decisional  law  of  New  York  recognizes  a  former  patient's  entitlement  to  his 
medical  files  in  the  absence  of  pending  litigation.  "'^■''    The  case  involved  a  woman 
who  wanted  her  records  to  help  her  write  a  book  about  her  experiences.     This  case 
is  on  appeal  to  the  Supreme  Court. 

Thus,  in  states  with  access  statutes,  patients  often  must  sue  to  enforce  the 
statute.    In  states  without  them,  hospital  medical  records  are  usually  governed  by 
regulations  of  the  state  hospital  licensing  agency.    A  sample  of  these  regulations 
indicates  that  most  permit  hospitals  to  adopt  restrictive  access  procedures. "^^ 
While  all  states  permit  inspection  upon  court  order,  many  limit  access  to  the 
patient's  attorney  or  insurance  company.    As  a  practical  matter,  then,  hospitals 
can  control  access  in  most  cases  in  which  the  patient  is  not  willing  to  resort  to 
litigation. 

The  access  statutes  do  not  cover  private  physician's  offices,  possibly  because 
while  legislatures  were  sure  of  their  power  to  regulate  hospitals,  they  were 
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uncertain  of  their  power  to  interfere  with  a  physicisin's  private  practice.  Civil 
liberties  groups  report  two  instarices  of  unsuccessful  attempts  by  patients  to  gain 
access  to  records  held  by  private  physicians:     In  one,  a  woman  was  not  able  to  find 
out  whether  an  infertility  drug  given  her  by  a  physician  20  years  ago  was 
stilbestrol,   now    suspected  of  being  related  to  cervical  cancer  in  female  offspring. 
In  the  second,  a  woman  who  recently  wrote  her  doctor  asking  what  medicine  she  was 
treated  with  a  few  years  previously  has  not  been  able  to  obtain  this  information.' 
The  possibility  of  a  malpractice  action  probably  explains  the  reluctajice  of  the 
doctors  in  these  cases. 

The  closest  analogy  to  private  physician's  records  and  access  is  x-rays.    In  a 
lower  court  case,  and  in  an  appellate  decision,  the  courts  held  that  the  physician 
owned  the  x-rays  and  did  not  have  to  grant  access  to  them  to  the  patient.'-'^ 

Legal  Trends  Toward  Greater  Patient  Access 

In  the  same  way  that  the  statutory  and  case  law  axe  reconsidering  access  in 
employer-employee  relations,  police  and  suspect,  seller  and  buyer, etc.,  so  too  is 
the  doctor-patient  relationship  undergoing  chaxige.    Before  i960,  all  a  physician 
needed  was  sufficient  patient  consent  to  protect  against  an  assault  and  battery 
action  for  linauthorized  touching.     Since  that  time,  state  courts  have  consistently 
recognized  that  before  giving  consent,  a  patient  needs  a  certain  sunount  of 
information  about  his  condition,  the  recommended  treatment,  and  its  probable  result! 
The  new  reasoning  here  is  that  the  patient  has  a  right  to  self-determination,  a 
right  to  refuse  or  to  choose  between  alternative  treatments. 


Before  1972,  legal  commentators  felt  safe  in  saying  that  a  physician  could  be 

77 

guided  by  the  doctrine  that  "good  medicine  is  good  law.'"'     In  that  year,  however, 

three  separate  jurisdictions  held  that  doctors  could  no  longer  limit  their 

disclosures  to  what  "the  average  medical  practitioner  would  disclose  under  similar 

circumstances."'^      The  new  test  must  be  based  on  the  patient's  need  to  know,  that 

is,  whether  the  patient  was  told  enough  about  the  treatment  and  its  risks  (death, 

disability,  recuperation)  to  decide  whether  to  accept  the  doctor's  recommendation. 

This  duty  to  disclose,  ironically,  was  based  precisely  on  the  "fiduciary  nature" 

of  the  doctor-patient  relationship  that  the  AMA  has  relied  upon  to  deny  patients 
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access  to  their  medical  records.^    These  decisions  are  as  yet  the  rule  in  only 

a  few  states,  but  they  indicate  the  trend  of  some  courts  to  view  the  doctor-patient 

relationship  as  a  decision-making  partnership  instead  of  as  a  medical  monopoly. 

While  the  courts  have  taken  a  giant  step  in  recognizing  patient  autonomy, 
physicians  may  still  invoke  the  "therapeutic  privilege"  to  deny  access.     The  general 
rule  stated  by  the  California  Supreme  Court  in  Cobbs  vs.  Grant  is:   "A  disclosure 
need  not  be  made... when  a  doctor  can  prove... that  the  disclosure  would  so  seriously 
upset  the  patient  that  the  patient  would  not  (be)  able  to  dispassionately  weigh 
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the  risks  of  refusing  to  undergo  the  recommended  treatment."  (emphasis  supplied) 
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While  this  tends  to  limit  the  doctrine  of  patient  access,  it  does  not  put  the 
physician  back  in  ultimate  control  of  patient  information.     It  is  now  presumed  that 
every  adult  patient  will  be  fully  informed  unless — as  the  court  held  in  Natanson  vs. 
Kline  -  the  physician  can  prove  that  "a  complete  disclosure ...  could  so  alarm  the 
patient  that  it  would,  in  fact,  constitute  bad  medical  practice..."        In  the 
ordinary  case,  there  would  seem  to  be  no  warrant  for  suppressing  facts. 

While  the  limits  of  the  "therapeutic  privilege"  have  not  been  carefully  defined, 
at  least  one  court  has  recommended  that  wherever  a  physiciain  invokes  it,  he  or  she 
should  be  required  to  disclose  the  information  to  a  close  relative. 82    The  problem 
with  this  approach  is  that  it  may  be  used  to  restrict  the  competent  patient's  role 
in  dec is ion -making,  treating  him  as  though  he  were  incompetent,  even  though  he  is 
not. 


The  Federal  Privacy  Act  of  197^  and  Its  State  Counterparts 

All  of  these  issues — of  privacy,  confidentiality  and  patient  access — are 
being  directly  affected  by  passage  of  legislation  controlling  the  use  of  information 
by  government  agencies  as  primary  health  providers.     The  Federal  Privacy  Act  of 
197^  requires  federal  agencies  which  maintain  identified  records  on  individuals  to 
1)  list  those  data  systems  and  their  purposes  in  the  Federal  Register;     2)  collect 
only  that  information  which  is  necessairy  for  the  agency  to  perform  its  duties; 
3)  state  the  "routine  uses"  of  the  data  collected,  for  which  it  is  not  necessary  to 
obtain  the  data  subject's  permission;     4)  obtain  the  individual's  signed  consent 
for  all  other  releases  of  information;     5)  keep  a  log  of  all  such  data  exchanges; 
and  6)  provide  data  subjects  with  access  to  their  own  records  and  the  opportunity 
to  correct  inaccuracies. 

In  addition,  seven  states  have  passed  similar  Fair  Information  Practices  Acts, 
(They  are  Minnesota,  Utah,  Arkansas,  New  Hampshire,  Massachusetts,  Ohio,  and 
Virginia. ) 

MEDICAL  RECORDS  FOR  SPECIAL  POPULATIONS 


Large  groups  of  people  have  medical  care  made  available  to  them  because  of 
their  special  relationship  to  a  particular  institution  or  organizationi     the  armed 
forces  provide  medical  ceire  for  servicemen  1     correctional  institutions  provide  it 
for  inmates;  some  industrial  corporations  provide  medical  care  for  employees;  and 
some  colleges  provide  it  for  students. 

Under  these  circumstances,  the  health  care  providers  are  not  usually 
independent  practitioners  but  employees  of  the  institution.     While  part  of  their 
function  is  to  serve  their  patients,  another  part  is  to  advance  the  goals  of  the 
institution.    Sometimes  this  dual  loyalty  serves  both  the  patient  and  the 
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institution  well;  sometimes  the  conflict  in  loyalty  undermines  the  doctor-patient 
relationship  and  interferes  with  the  delivery  of  medical  cgire. 

What  follows  is  a  brief  review  of  some  aspects  of  medical  record-keeping 
practices  in  correctional  institutions,  the  armed  forces,  employment  and  colleges. 

Correctional  Institutions.    What  must  be  emphasized  first  is  that  medical  care 
in  correctional  institutions,  like  every  other  aspect  of  inmate  life,  is  subordinate 
to  security. Almost  invajriably,  security  considerations  govern  where  medical  care 
is  given,  when  it  is  given,  and  who  participates.     This  means  that  patient 
interviews,  starting  with  admissions,  are  never  conducted  in  private.    There  are 
always  guards  present,  and  almost  always  other  inmates.    At  the  daily  sick  call,  it 
is  not  customary  to  keep  records  at  all. 

Here  is  a  description  of  daily  care  at  Attica  prison,  in  New  York  State; 

"Dr.  Williams  spent  most  of  his  time  with  inmates  separated  from 
them  by  a  wire  screen.    When  they  lined  up  for  sick  call,  he  and  aji 
associate  prison  doctor,  Paul  G.  Sternberg,  were  on  the  other  side  of 
a  waist-high  counter;  the  screen  ran  from  coiaiter  to  ceiling.  No 
examinations  were  given,  except  in  rare  cases.     The  patient  described 
his  problem.     Through  the  screen,  the  doctor  gave  him  medication,  often 
aspirin,  sometimes  a  placebo,  not  infrequently  a  tranquilizer  if  the 
complaint  was  psychological.     Sometimes  one  of  the  doctors  would  dismiss 
the  complaining  inmate  since  both  believed  they  could  tell  by  looking  at 
a  man  whether  he  was  malingering. "  84 

In  the  District  of  Columbia  jail,  the  sick  call  is  almost  identical  with  the 
one  described  above,  except  that  a  pre-screening  of  inmates  who  place  themselves 
on  sick  call  is  conducted  by  Medical  Assistants,  inmates  who  have  already  been 
convicted  of  crimes  and  who,  ironically,  are  accorded  higher  privileges  than 
those  awaiting  trial. The  Medical  Assistants  msike  the  roimds  of  the  cellblocks 
and  dispense  aspirins  to  those  inmates  whom  they  do  not  consider  ill  enough  to  go 
on  sick  call.     As  in  the  other  two  institutions,  prisoners  with  medical  emergencies 
are  taken  to  the  city  hospital  for  treatment. 

Thus,  for  the  great  majority  of  the  prison  population  in  these  institutions 
and  others  like  them, there  is  very  little  formal  medical  record-keeping,  except 
for  the  relatively  rare  prisoner  who  is  treated  in  an  outside  city  hospital. 
Copies  of  these  outside  medical  records  are  given  to  the  institution's  administrators. 
Sometimes  they  are  not  even  given  to  its  medical  staff. 

The  lack  of  medical  records  for  inmates  treated  in  outside  hospitals  hsmdicaps 
the  limited  medical  staff  of  the  prison  even  further.     Dr.  John  L.S,  Holloman 
recounts  the  difficulty  of  dealing  with  a  patient  in  New  York  who  had  been  shuffled 
often  between  the  jail  and  the  county  hospital.        The  inmate  was  suffering  from 
severe  neurological  damage.     "He  has  made  numerous  trips  to  the  hospital  facilities. 
Nevertheless  there  is  no  medical  information  concerning  the  prisoner  available  to 
the  medical  staff  here.     To  send  patients  for  care  and  then  to  fail  to  keep  useful 
medical  records  seems  to  be  a  waste  of  effort  and  money." 
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According  to  Arpiar  Saunders,  Associate  Director  of  the  National  Prison 
Project,  most  medical  information  about  prisoners  is  placed  in  their  general  records 
by  non-medical  personnel,  primarily  guards,  but  sometimes  by  prison  teachers, 
social  workers  or  the  clerical  staff. 

If  the  facility  is  a  detention  center  rather  than  a  permanent  prison,  the 
general  record,  including  medical  information,  follows  the  prisoner  when  and  if  he 
is  assigned  to  a  permanent  institution.     Many  permanent  prisons  assign  inmates  to 
cellblocks  according  to  the  seriousness  of  the  crime,  and  also  according  to  the 
evaluations  made  in  the  detention  center.     If  the  inmate's  record  shows  that  he 
was  a  "troublemaker,"  or  a  homosexual  or  a  malingerer,  he  may  be  assigned  to  an 
undesirable  cellblock,  or  a  segregated  cell,  or  put  on  "deadlock"  (confined  to 
cell  with  no  privileges). 

Inmates'  records  are  routinely  available  to  prison  personnel.     In  addition  to 
playing  a  role  in  initial  cell  assignments,  they  axe  used  by  disciplinary  boards 
within  the  institution  and  may  play  a  role  in  determining  the  severity  of  punishment 
for  an  infraction.     They  are  also  used  by  parole  boards,  who  give  considerable 
weight  to  derogatory  comments  by  guairds  when  deciding  whether  or  not  to  grant  parole 

Medical  Records  in  the  Armed  Forces;     Military  doctors  have  an  affirmative  duty 
to  report  to  the  military  command  any  medical  information  they  think  relevant  to 
the  soldier's  performance  or  status.     "Military  law,  quite  simply,  does  not 
recognize  the  physician-patient  privilege,"  according  to  Captain  David  B.  Knoll  of 
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the  Judge  Advocate  General  Corps.        He  goes  on  to  note  that  "...A  military  doctor 
performs  examinations  as  part  of  his  official  duties,  and  information  thereby 
acquired  would  be  official.     Maintenance  of  complete  medical  records  on  all  persons 
in  the  military  services  is  of  substantial  concern  to  the  services  themselves." 

The  lack  of  a  physician-patient  privilege  is  crucial  for  members  of  the  armed 
forces  since  the  medical  information  they  volunteer  to  military  doctors  may  be  used 
by  the  command  to  determine  their  fitness  for  promotion,  or  whether  or  not  they 
should  be  summoned  before  aji  administrative  hearing  board  or  court-martialed.  If 
either  of  these  disciplinary  procedures  is  invoked,  militsiry  doctors  may  give 
evidence  at  them  based  upon  what  the  servicemein  or  woman  confided  in  them. 

Where  a  court-martial  is  a  possibility,  military  physicians  are  required  to 
give  the  patient  some  form  of  an  "Article  31"  warning  that  what  he  says  may  be  used 
against  him.     The  military  version  of  the  Fifth  Amendment  provides;     "...no  person., 
may  interrogate  or  request  any  statement  from  an  accused  or  a  person  suspected  of 
an  offense  without  first  informing  him  of  the  nature  of  the  accusation  sind  advising 
him  that  he  does  not  have  to  make  any  statement  regarding  the  of f ense . . . and  that 
any  statement  made  by  him  may  be  used  as  evidence  against  him  in  a  trial  by 
court-martial."    The  militeiry  physician,  however,  does  not  have  to  use  the  formal 
language  of  Article  31.     It  is  enough  for  him  to  tell  the  patient  that  whatever  he 
says  during  an  interview  is  not  privileged. 
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However,  no  such  warning  is  necessary  lonless  a  court-martial  is  in  the  offing, 

as  a  recent  case  demonstrates.    A  private  voluntarily  consulted  an  Army  psychiatrist 
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for  help  about  his  homosexual  feelings.        On  the  following  day,  the  psychiatrist 
filed  a  detailed  report  with  the  soldier's  superiors,  and  recommended  that  he  be 
discharged  for  administrative    reasons  under  the  provisions  of  the  regulations 
regarding  homosexuality  (undesirable  discharge).    The  recommendation  specifically 
noted  that  there  was  no  evidence  of  a  mental  illness  which  would  necessitate  a 
medical  discharge.     (A  medical  discharge  entitles  a  soldier  to  veteraais '  benefits.) 
The  soldier  describes  the  consequences  of  the  psychiatrist's  recommendation: 

"Discharge  proceedings  were  begun  against  me  and,  after  being 
threatened  with  a  court-martial,  I  signed  a  statement  and  waived  my 

right  to  counsel  and  a  hearing. . .     Shortly  thereafter  H          and  others 

told  me  I  had  to  name  names  or  I  would  not  get  out.     Under  such  coercion, 

I  named  P   and  then,  regretting  what  I  was  forced  to  do,  I  denied  it 

ajid  all  the  other  admissions  as  well... 

"In  the  past  ten  years  my  undesirable  discharge  has  haunted  me...  My 
civil  service  job  application  was  returned,  and  Bank  of  America  rejected 
an  application  for  a  Federally  Insured  Student  Loan... The  VA  also  denied 
me  my  veterans'  benefits.     Despite  the  incidents  ten  years  ago,  I  repeat, 
as  I  did  then,  that  I  am  not  a  homosexual..." 

As  the  above  case  makes  clear,  medical  information  not  only  affects  the 
serviceman  or  woman's  career  while  in  the  armed  forces,  it  also  affects  the  kind 
of  discharge  he  or  she  receives,  which  in  turn  affects  the  veteran's  opportunity  for 
employment  and  his  or  her  eligibility  for  veterans'  benefits. 

Until  March,  19?^.  servicemen  and  women  were  given  a  Separation  Program  Number 

on  their  general  or  honorable  discharge  papers  which,  unbeknownst  to  the  veteran, 

was  a  code  to  employers  and  others  and  which  frequently  signified  derogatory 
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information.        Many  of  these  numbers  were  based  on  medical  information  or  records. 
Among  them: 

Codes  249-257  -  homosexuality;     26l  -  Psychiatric  or  psychoneurotic  disorder; 
262-263  -  bedwetting;     264-  -  behavior  disorders;  274,277,278  -  physical  disability, 
not  entitled  to  severance  pay;     287  -  unclean  habits,  venereal  disease;  288- 
anti-social  behavior;     289  -  alcoholism;     361-362  -  homosexual  tendencies  (without 
overt  homosexual  acts);     369  -  cyclothymic  personality  (manic-depression); 
375  -  failure  to  meet  medical  fitness  stajidards;     384  -  drug  abuse;     388  sexual 
perversions;     4lE  obesity;     46B,  46D  -  sexual  deviate;     460  -  schizoid  personality; 
480  -  personality  disorders;     552  -  court-martial,  homosexual;     651  -  physically 
disqualified. 

More  than  400,000  Vietnam  veterans  have  been  given  such  derogatory  separation 
numbers.     While  these  secret  numbers  may  frequently  adversely  affect  a  veteran's 
job  opportunities,  an  undesirable  or  dishonorable  discharge  is  virtually  certain 
to  do  so.     Such  discharges  are  also  an  outright  bar  to  veterans'  benefits  in 
housing,  education,  pensions,  medical  care  and  civil  service  ratings. 
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Medical  Records  in  Employment 

Although  virtually  all  businesses  provide  group  health  insurance  coverage  to 
their  employees,  most  corporations  limit  primary  medical  care  to  first  aid  stations 
and  periodic  health  screenings.     The  IBM  Company  is  a  good  example  of  a  large 
corporation's  occupational  health  program  in  which  special  attention  has  been 
given  to  the  rules  for  information  use. 

IBM  has  250,000  employees,  150,000  of  them  stationed  in  the  United  States. 

Its  domestic  medical  department  employs  120  nurses,  32  full  time  physicians,  ^0 

part-time  specialists,  including  psychiatrists,  and  250  "fee  for  services" 

physicians.     Its  medical  facilities  handle  650,000  employee  visits  per  year, 
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150,000  of  which  involve  physician  contact.^ 

Between  lOfo  and  20^  of  all  first-aid  visits  are  for  occupational  injuries;  the 
remainder  are  for  non-occupational  illnesses  or  injuries.     In  addition  to  providing 
treatment  for  specific  complaints,  IBM  offers  a  Voluntary  Health  Screening 
Examination  Program.    Approximately  75?^  of  all  employees  participate  in  this 
multiphasic  screening  system.     In  the  introduction  to  the  pamphlet  explaining  the 
Screening  Program,  employees  are  told: 

"The  program  is  completely  voluntary , and  the  decision  to  teLke  part 
in  it  is  entirely  up  to  you.     I  also  want  to  emphasize  the  confidential 
nature  of  your  examination  results  which  are  seen  by  the  professional 
staff  members  of  the  IBM  Medical  Department,  your  personal  physician  if 
you  wish,  and  no  one  else.     The  only  instance  where  health  information 
is  obtained  during  an  examination  would  have  to  be  revealed  is  when  an 
employee  is  found  to  have  a  suspected  communicable  disease  which  must  be 
reported  under  State  law." 

The  Voluntary  Health  Screening  Examination  Program  is  designed,  according  to 
Dr.  John  Duffy,  Director  of  IBM's  Medical  Department,   "Xo  give  the  employee  advance 
warning  of  the  most  common  chronic  health  problems,  as  well  as  to  alert  the 
employee  to  conditions  which  could  cause  future  health  problems.     The  frequency 
of  medical  screenings  depends  on  ain  individual's  age.     The  older  a  person  becomes, 
the  more  often  the  screenings  take  place . " 

All  results  of  tests  comprising  the  Screening  Examination  are  fed  into  a 
computer  which  compares  them  with  the  expected  statistical  profile  for  the  employee's 
sex  and  age,  and  with  any  earlier  Screening  Examinations  that  the  employee  may  have 
taken.     The  computer  then  produces  a  detailed  report  of  the  Screening  Examination, 
making  special  note  of  irregulsirities .     The  report  is  then  forwarded  to  the  IBM 
Medical  Department  where  it  is  inserted  into  the  employee's  confidential  medical 
record.     If  a  potential  health  problem  is  disclosed  by  the  report,  an  IBM  physiciein 
or  nurse  will  suggest  that  the  employee  consult  his  or  her  personal  physician. 
Upon  receiving  the  consent  of  the  employee,  the  latter 's  personal  physician  will  be 
advised  of  the  results  of  the  screening  examination.    Dr.  Duffy  especially  notes 
that  "the  results  of  the  examination  will  have  no  effect  whatsoever  on  the  employee's 
job." 
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In  addition  to  its  express  purpose  of  advising  individual  employees  about  their 
health,  the  program  is  designed  to  furnish  statistical  data.    With  the  aid  of  the 
computer,  health  examination  information  is  gathered  on  men  eind  women  of  widely 
varying  age,  geographic  location  and  medical  history.     The  results  in  summary  form 
enable  the  IBM  Medical  Department  to  develop  prognostic  techniques.     The  brochure 
describing  the  research  aspects  of  the  program  points  out  that« 

"All  medical  data  used  in  these  research  studies  will  be  handled  in 
a  completely  confidential  and  ajionymous  manner,  and  will  in  no  way  identify 
individual  participants  in  the  program." 

Although  the  Medical  Department  does  not  make  medical  records  available  to 
company  managers  or  supervisors,  it  does,  with  the  employee's  knowledge,  inform 
management  when  a  medical  problem  is  work -related,  so  that  an  employee  with 
epilepsy,  for  example,  would  not  be  assigned  to  handle  high-voltage  equipment. 
Approximately  5%  of  all  employees  are  within  the  Bureau  of  Labor  Standards  definition 
of  handicapped,  and  20%  are  subject  to  restrictions  (epileptic,  controlled  diabetic, 
etc.)      The  same  policy  is  applied  to  the  psychiatric  consultation  provided.  If 
there  is  no  problem  with  performance  at  work,  there  is  no  feedback  to  management. 
"When  illness  is  impacting  job  performance  or  a  job  is  contributing  to  illness, 
management  is  given,  on  a  need-to-know  basis,  the  recommendations  which  will  best 
serve  the  needs  of  the  employee  emd  the  company." 

IBM  comjilies  with  all  State  and  Federal  reporting  requirements,  including 
findings  of  drug  abuse  among  employees  and  infection  with  communicable  diseases. 
It  complies  with  the  record-keeping  requirements  of  the  Occupational  Safety  and 
Health  Act  which  requires  the  maintenance  of  up-to-date  records  on  occupational 
injuries  and  illness  to  be  made  available  on  request  to  government  officials.  The 
company  must  also  furnish  appropriate  records  to  the  Workmen's  Compensation  Bureau 
on  request. 

In  this  connection.  Dr.  Duffy  noted  that  while  Social  Security  numbers  are 
used  in  filing  these  V/orkmen's  Compensation  reports,  IBM  uses  its  own  numbering 
system  for  internal  medical  records  of  its  employees. 

When  IBM  Medical  Department  records  are  subpoenaed,  the  company  will  copy 
medical  department  records  and  send  them  to  the  employee's  personal  physician  upon 
receiving  the  written  consent  of  the  employee. 

The  range  of  medical  services  pr.ovided  by  IBM  for  its  employees  is  typical  of 
the  practices  of  the  big  corporations  listed  in  Fortune  magazine's  Leading  500 
Companies.     The  special  policies  that  IBM  has  adopted  to  protect  the  privacy  of 
employee  medical  records  will  be  described  in  the  concluding  chapter. 


36 


Medical  Records  in  Colleges 


Majiy  colleges  and  universities  maintain  student  health  services  where  primeiry 
care  is  provided  by  physicians  and  other  health  professionals  employed  by  the 
school.     (Elementary  and  secondary  schools  generally  provide  only  specialized 
services  such  as  immunizations,  eye  and  hearing  tests,  etc.  and  these  record- 
keeping practices  are  described  in  Zone  III.) 

A  survey  conducted  in  I968  of  I65  American  colleges  and  universities  (and  8 
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Canadian  universities)  examined  their  medical  record-keeping  practices.^  While 
the  survey  focussed  primarily  on  student  psychiatric  records,  it  revealed  some 
general  medical  record  keeping  procedures  as  well. 

Virtually  all  of  the  school  medical  directors  acknowledged  the  need  for 
confidentiality  of  student  medical  records.    As  one  medical  director  put  it:  "If 
the  student  body  does  not  know  without  any  doubt  that  their  contacts  with  the 
health  service  will  be  treated  as  privileged,  then  the  very  effectiveness  of  this 
health  service  is  quickly  lost,"    But  in  spite  of  the  endorsement  in  principle, 
the  practices  among  schools  varied  widely. 

1,  Informing  Parents ;     The  great  majority  of  American  schools  -  1^5  in  all  - 
responded  to  the  survey  by  stating  that  parents  are  not  routinely  informed  by  the 
health  service  when  the  treatment  is  for  short-term  illness  or  on  an  outpatient 
basis.     Most  of  the  schools,  however,  do  notify  peirents  of  hospitalization,  serious 
illness,  or  a  suicide  attempt.     The  eight  schools  which  do  not  inform  parents  under 
any  circumstances  are  all  graduate  schools  where  the  great  majority  of  students  may 
be  assumed  to  be  over  21  and/or  married. 

The  20  schools  that  do  inform  parents  of  all  treatment  by  the  student  health 
service  do  so  for  one  or  more  of  the  following  reasons:   (a)  the  school  believes  it 
has  a  moral  responsibility  to  inform  parents;  or  (b)  believes  it  has  a  legal 
responsibility  to  do  ^o;  or  (c)  believes  that  since  the  parents  are  paying  the 
school  bills  they  have  a  right  to  the  information, 

2.  Informing  the  Administrationt    Where  the  student  himself  seeks  treatment  — 
either  general  or  psychiatric  —  the  administration  and  faculty  of  the  school  are 
generally  not  informed  without  the  consent  of  the  student  unless  the  student  is  very 
ill,  or  his  condition  poses  a  danger  to  himself  or  others.    Fifteen  of  the  schools 
report  the  names  of  all  students  hospitalized  in  the  college  infirmary,  but  without 
diagnosis,  medical  or  psychiatric.     Forty-four  schools  report  to  the  administration 
when  some  sort  of  scheduling  adjustment  is  required,  such  as  withdrawal  from  school, 
or  a  course  change ,  or  a  dormitory  change ,  but  this  is  done  with  a  minimum  of 
disclosure  from  the  student's  record.     The  medical  service  might  request  a  change 

in  schedule  because  of  "a  stressful  situation,"  or  because  roommates  sire  not 
"psychologically  compatible,"  without  giving  details  about  the  actual  conduct  of 
the  student . 
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However,  when  the  administration  refers  the  student  to  the  mental  health 
service,  the  majority  of  schools  will  inform  the  student  at  the  outset  that  a  report 
will  be  made  to  the  dean.     Many  of  the  schools  indicate  that  they  discuss  the 
evaluation  with  the  student  before  giving  it  to  the  dean. 

3.     Informing  Outside  Organizations!     Only  eight  American  schools  report  that 
they  will  release  medical  information  to  outside  organizations  without  student 
consent.     All  of  the  others  state  that  they  would  reveal  no  information  without 
student  consent  (or  without  parental  consent  if  the  student  is  under  21).  However, 
this  may  include  the  routine  or  blanket  consent  that  students  give  when  they 
undertake  treatment,  or  it  may  include  a  blanket  consent  signed  in  connection  with 
an  insurance  application  or  a  licensing  or  employment  application. 

Some  schools  say  they  require  informed  consent;     that  is,  they  call  the  student 
in  and  ask  him  about  the  specific  inquiry  and  discuss  the  information  they  will 
release  if  he/she  permits  it.     This  protection,  of  course,  is  useful  only  when  the 
student  is  still  in  the  college.     Many  inquiries  are  made  after  the  student  has 
graduated. 

Nineteen  colleges  state  they  will  release  information  with  student  permission 
only  on  a  "specific  request,"  although  it  is  not  clear  what  the  specificity  refers 
to.     One  college  among  these  explains  that  it  will  respond  only  to  "specific 
questions"  about  the  student.     It  reports  that  after  instituting  this  requirement, 
the  number  of  requests  for  information  has  dropped  from  several  per  week  to  three 
or  four  a  year. 

Thirteen  American  universities  indicated  that  they  refuse  psychiatric 
information  to  an  outside  agency  even  with  the  student's  consent.     Six  of  these 
make  an  exception  for  a  new  therapist  in  another  school  who  is  continuing  to  treat 
the  student.     This  is  the  position  of  the  Psychiatry  Division  of  the  Berkeley 
Student  Health  Service : 

"Years  of  experience  and  discussion  have  led  our  staff  to  conclude 
that  we  cannot  comply  with  such  requests  (for  information  and  opinions 
about  students  who  have  used  our  services)  and  that  communication  about 
our  work  with  students  is  justified  only  for  the  purpose  of  contributing 
to  further  psychotherapy  elsewhere ...  Our  attitude  and  policy  about 
confidentiality  are  not  affected  by  a  student's  having  provided  his 
release  or  consent  to  communication." 

The  practices  of  the  majority  of- schools  with  respect  to  informing  parents 
and  administration  officials  conform  to  the  general  standards  set  by  the  American 
College  Health  Association.     But  ACHA  standards  are  not  followed  by  the  majority  as 
to  releasing  student  medical  records  to  outside  organization.     The  ACHA  would  permit 
more  disclosure  to  groups  such  as  draft  boards,  insurance  companies  and  prospective 
employers  than  the  majority  of  colleges  are  willing  to  make. 
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The  ACHA  would  give,  with  student  consent,   "more  specific  information  about 
diagnosis,  results  of  therapy  and  prognosis"  than  would  be  given  to  university 
admissions  committees.    And  it  would  allow  even  further  disclosure  to  the  FBI,  the 
Civil  Service  Commission  and  the  armed  forces.    For  these  agencies,  ACHA  suggests 
"a  general  review  of  the  case  history  along  with  guarded  prognostic  speculation  in 
the  course  of  an  interview  with  the  investigating  agency... but  even  this  should 
only  be  done  if  it  is  clear  that  refusing  to  give  information  will  be  seriously 
damaging  to  a  former  patient," 

According  to  the  survey,  one  of  the  factors  which  has  caused  stiffening  of 
resistance  to  disclosure  of  student  medical  records  to  outside  agencies  has  been 
the  experience  with  the  Peace  Corps,     "(It)  comes  armed  with  a  student  consent  and 
asks  for  full  information.     Many  of  the  schools  that  have  developed  new  policies 
in  recent  years  to  avoid  disclosure  of  records  have  done  so  because  of  the  growing 
number  of  requests  for  information  from  the  Peace  Corps." 

In  197^  Congress  passed  the  Family  Educational  and  Privacy  Act  (the  so-called 
Buckley  Amendment)  which  sets  rules  of  confidentiality  and  rights  of  student  access 
to  records  in  schools  and  colleges , including  medical  records  that  are  maintained 
by  such  institutions, 

CONCLUSIONS 

If  free  medical  and  health  care  could  be  delivered  by  doctors  and  paramedics  on 
the  proverbial  desert  island,  freed  from  all  the  surrounding  obligations  of  organized 
society,  the  citizen  rights  issues  present  would  involve  relatively  manageable 
problems.     In  urban  societies,  however,  the  primary  care  providers  we  have  described 
in  Zone  I  are  under  many  legal  and  social  obligations  to  disclose  personal  medical 
data.     These  obligations  are  growing  greater  and  greater  as  society  tries  to  cope 
with  problems  of  improving  public  health,  occupational  health  and  safety,  research 
into  diseases,  evaluation  of  health  care  systems,  and  similar  activities.  In 
addition,  most  patients  now  have  their  doctor  and  hospital  bills  paid  by  someone  else 
requiring  personal  and  medical  data  to  be  disclosed  for  service  payment  and  care 
review. 

In  the  face  of  these  unavoidable  realities ,  the  records  generated  in  primary 
care  settings  can.  no  longer  be  treated  solely  in  terms  of  what  information  doctor 
and  allied  health  professionals  need  to  do  their  job.  Precisely  because  law  and 
public  norms  require  considerable  disclosure  of  what  is  collected  here,  the 
recording  of  personal  data  in  primary  care  can  no  longer  be  analyzed  in  isolation, 
and  the  delicate  balances  of  the  doctor- patient  relationship  treated  by  themselves. 
What  is  gathered  and  recorded  must  be  seen  today  as  the  start  of  a  complex  process 
of  outward  communication,  with  medical  data  going  into  many  areas  far  removed  from 
direct  patient  care.     It  is  to  these  additional  uses  that  we  now  turn. 
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CHAPTER  2.     ZONE  II  -  SERVICE  PAYERS  AND  HEALTH  CARE  REVIEWERS 


Medical  records  in  Zone  II  are  not  used  for  the  delivery  of  primary  health 
care  by  government  and  private  agencies.     They  are  used  for  two  separate  but  closely 
related  purposes.     The  first  is  for  the  payment  of  health  care  for  those  individuals 
eligible  for  medical  benefits  under  government  programs  or  private  insurance  plajis. 
The  second  is  to  monitor  the  costs  and  quality  of  care  given  to  these  patients. 

Medical  Service  Payers 

One  hundred  ninety  million  Americans  are  covered  by  some  form  of  public  or 
private  health  insurance.     The  estimated  total  cost  of  this  insurance  is  $57  billion 
dollars  a  year.     Health  insurance  is  not  only  a  major  American  preoccupation,  it  is 
a  major  occupation  as  wells     150,000  Americans  work  for  federal,  state  and  local 
government  health  insurance  plans t  Blue  Cross -Blue  Shield  has  70,000  employees; 
private  commercial  health  insurance  companies  employ  500,000  people. 

Service  payers , whether  government  agencies  or  private  companies,  need  to  have 
positive  identification  of  the  patient  and  to  know  what  medical  services  he  or  she 
received.     Without  this  basic  information,  they  could  not  honor  claims  for  benefits 
or  reimburse  doctors  and  hospitals.     They  frequently  need  more  than  this  basic 
information  to  protect  themselves  against  fraud  by  the  patient  or  by  the  health  care 
provider.     Private  companies  also  collect  medical  information  and  other  personal 
data  in  advance  of  granting  insurance  coverage  to  make  certain  that  the  individual 
is  a  good  medical  and  financial  risk.     What  follows  is  a  description  of  how  service 
payers  operate,  what  their  sources  of  medical  information  are,  and  how  they  use 
the  medical  information  they  collect. 

Private  Service  Payers 

In  1973i  182  million  Americans  were  covered  by  some  form  of  private  health 
insurance.     Insurance  companies  provide  60%  of  this  coverage  today.  Blue  Cross-Blue 
Shield  provide  44%,  and  other  prepaid  insurance  plans  provide  9%.     (These  figures 
add  up  to  more  than  100%  because  many  individuals  have  coverage  with  more  than  one 
organization.  ) More  than  75  million  Americans    j^g^yg  ^q^q  form  of  disability  insurance? 

Widespread  as  this  health  insurance  coverage  is,  it  is  by  no  means  universal. 
Some  20  million  Americans  have  no  coverage  at  all.     Nor  is  coverage  evenly 
distributed  in  the  population.     Some  families  are  covered  for  only  a  small  fraction 
of  their  medical  bills,  v;hile  others  are  enrolled  in  programs  that  provide  a  full 
range  of  medical  services.-^    All  of  this  means  that  for  every  individual  covered  by 
private  insurance,  decisions  must  be  made  as  to  his  or  her  eligibility,  what  rate 
he  or  she  should  pay,  and,  once  covered,  whether  claims  for  benefits  should  be  paid. 


Most  health  insurance  coverage  however,  is  not  by  individual  policy.  Group 
health  insurance  policies  cover  83  million  Americans,  compared  with  only  4b  million 
who  have  individual  policies.      Employment  by  a  particular  firm  guarantees  health 
coverage  at  a  rate  common  to  all  the  employees  without  any  requirement  that 
individual  workers  provide  medical  information  about  themselves.     The  rate  the 
group  member  pays  depends  not  on  his  or  her  physical  condition,  but  on  decisions 
the  employer  makes  about  the  whole  group.     This  can  affect  hiring  policies  when 
employers  try  to  keep  insurance  rates  low  by  hiring  the  "right"  kind  of  people. 
(This  will  be  discussed  in  the  Employment  section  in  Zone  III.) 

The  information  obtained  from  the  individual's  application  form  is  the  major 
source  used  for  health  underwriting  decisions.     On  it,  the  applicant  may  be  asked 
to  include  recent  hospitalizations,  major  illnesses,  a  medical  history,  the 
existence  of  "nervous"  and  mental  disorders,  etc.^    No  insuremce  company  investigates 
all  applications,  although  most  of  the  larger  health  insurance  firms  check  new 
applications  against  their  previous  applications  and  claims  files. ^ 

Little  is  known  about  what  percentage  of  applications  are  checked  further,  or 
how  the  decision  to  check  further  is  made.     Mutual  of  Omaha,  the  largest  provider 
of  private  health  insurance,  states  that  it  checks  only  5%  of  health  insurance 
applications  beyond  the  application  form.       (Mutual's  operations  are  described  in 
detail  in  the  Profiles  section. ) 

Once  a  decision  has  been  made  to  go  beyond  the  application  form,  private 
insurers  may  check  physicians'  or  hospital  records.     Insurance  applicants  sign  a 
release  form  when  they  apply,  giving  the  company  access  to  medical  records  emd 
other  sources  of  information,  and  patients  entering  a  hospital  are  required  to  sign 
a  form  giving  the  hospital  authority  to  release  their  records  to  insurance  companies 
and  others. 

When  an  insurance  company  finds  something  "doubtful"  in  the  application,  or 
the  check  of  its  own  files,  it  may  order  a  further  investigation.     The  doubtful 
information  could  be  about  the  applicant's  surroundings  or  a  dangerous  occupation. 
Checks  are  also  made  when  the  application  is  for  a  large  amount  of  income-protection 
insurance.     The  investigation  may  be  made  by  the  company's  own  investigative 
department,  but  more  likely  it  will  be  conducted  by  an  outside  firm  that  specializes 
in  investigative  reports,  such  as  Hooper-Holmes,  Service  Review, Inc.,  American 
Service  Bureau,  O'Hanlon's  Report,  or  Retail  Credit  Corporation. 

The  largest  of  these  companies  is  Retail  Credit,  which  employs  8,500  people  in 
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1,600  branch  offices  in  the  United  States,  Mexico,  Csmada  and  the  West  Indies. 
Its  reports  for  health  service  payers  include  not  only  information  about  the 
applicant's  health,  but  frequently  comments  about  personal  habits  and  morals, 
employment,  police  records  check,  income  and  indebtedness. 
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Processing  of  Health  Insurance  Claims 


In  the  processing  of  claims,  the  patient's  medical  record  is  the  chief  source 
of  information,  often  the  only  source.     The  health  insurance  industry  routinely 

Q 

collects  three  types  of  information  from  the  patient  record:-^ 

(1)  patient  identification,  including  name,  address,  name  of  subscriber, 
relationship  of  patient  to  subscriber,  patient's  occupation  and  employer,  age,  sex 
and  identifying  number; 

(2)  clinical  information,  including  attending  physician,  referring  physician, 
description  of  accident  or  illness,  description  of  operations  or  medical  procedures, 
and  final  diagnosis  and  complications; 

(3)  financial  information,  including  length  of  stay, charge  per  day,  and 
accommodations. 

In  the  Blue  Cross  system,  after  this  material  has  been  used  for  reimbursing 
the  patient  or  the  hospital,  the  clinical  information  is  usually  separated  from 
the  identifying  information  and  is  used  for  actuarial  ratings,  claims  and 
utilization  review,  administrative  studies  and  research. '''^ 

Blue  Cross  has  developed  a  three-level  claims  review  procedure.     Level  One 
consists  of  screening  all  claims  against  established  parameters  of  length  of  stay, 
ancillary  charges  and  other  stajmdards  which  identify  misutilization  of  services. 
Claims  that  are  not  approved  at  Level  One  are  likely  to  involve  unnecessary  private 
room  charges;  diagnoses  of  chronic  diseases  without  mention  of  current  exacerbations; 
symptoms  rather  than  diagnoses;    unusually  long  or  short  hospital  stays;  unusually 
high  or  low  ancillary  charges  for  particular  diagnoses;  and  Blue  Cross  contractual 
exclusions.     Level  One  claims  are  reviewed  by  specially  trained  clerks. 

Claims  referred  to  Level  Two  are  usually  evaluated  by  Blue  Cross  staff 
registered  nurses.     Where  length  of  stay  is  being  reviewed,  in  addition  to  the 
established  standards,  the  reviewer  will  consider  the  age  of  the  patient,  the 
hospital  involved,  secondary  diagnoses  or  complications,  days  spent  in  intensive 
care,  and  use  of  smcillary  services. 

In  addition,  some  conditions  automatically  call  for  review  at  Level  Two.  Among 
them  are  obesity,  rehabilitation  procedures,  maternity,  cosmetic  surgery, 
pre-existing  conditions,  dental  care,  hospital  stay  for  diagnostic  purposes,  and 
mental  and  nervous  conditions.     The  mental  and  nervous  category  includes  alcoholism, 
drug  addiction,  attempted  suicide,  psychoneurotic  and  personality  disorders, 
epilepsy,  migraine,  colitis,  convulsions,  and  other  conditions.     Final  diagnoses 
that  mention  only  the  above  require  additional  information  before  the  claim  is 
reviewed.     A  request  is  sent  to  the  hospital  for  copies  of  physicians'  orders, 
history  of  present  illness,  history  of  past  illness,  examination  and  test  reports, 
progress  notes,  etc. 
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If  a  claim  cannot  be  approved  at  Level  Two,  it  is  referred  to  Level  Three  for 
further  review  by  a  Blue  Cross  staff  physician,  who  may  make  additional  requests 
to  the  hospital  for  information,  including  the  patient's  entire  medical  record. 

The  reason  for  this  three-level  approach,  beyond  identifying  those  conditions 
that  are  not  covered  by  the  contract,  is  to  review  those  diagnoses  that  most  readily 
lend  themselves  to  fraud  by  physicians  and  other  health-care  providers.  Cut-and- 
dried  medical  procedures — setting  a  broken  leg,  for  instance — present  very  few 
such  opportunities.     But  illnesses  that  require  long-term  therapy,  where  the  outcome 
cannot  be  predicted,  are  prime  possibilities  for  drawing  out  the  treatment  and  for 
exaggerating  the  amount  of  care  given  to  increase  the  amount  of  reimbursement  due 
to  the  health-care  provider.     While  insurance  companies  feel  that  for  this  reason 
records  in  this  category  deserve  closer  scrutiny,  the  health-care  providers  feel 
that  such  records,  especially  psychiatric  illnesses,  should  be  protected  against 
unnecessary  examination  because  of  the  sensitive  materials  they  contain. 

According  to  a  report  by  the  American  Medical  Records  Association  in  197^*: 

"There  are  two  basic  problems  that  severely  affect  the  processing 
of  claims  in  any  Blue  Cross  plan  ajid  probably  in  all  health  insurance 
companies t     insufficient  information  and  incorrect  information. .Money 
and  majipower  could  be  saved  if  hospitals  carefully  controlled  the 
submission  of  information  to  insurance  companies;  and  if  in  turn  these 
companies  notified  the  hospital  precisely  why  additional  information  is 
required. " 

Citizen      Rights  Issues 

Access ;     Since  1971,  Retail  Credit  and  similar  firms  have  come  under  regulation  of 
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the  Federal  Fair  Credit  Reporting  Act.        An  insurance  company  or  employer  who 
wishes  to  have  an  investigative  report  prepared  on  an  applicant  must  notify  the 
applicant  of  this  fact,  briefly  describing  the  topics  that  the  report  will  cover. 
If  the  applicant  is  turned  down  on  the  basis  of  information  in  the  report,  the 
company  must  notify  the  applicant  of  the  name  of  the  agency  that  produced  the  report. 
The  investigating  agency  is  then  required  to  discuss  each  report  with  the  applicant 
at  his  or  her  request.     It  must  inform  the  individual  of  the  contents  of  the  report, 
but  is  not  required  to  show  it  or  to  provide  a  copy  of  it. 

Several  exceptions  under  this  law  are  important:     Claims  investigations  are  not 
covered.     Medical  information  does  not  have  to  be  discussed.     In-house  insurance 
investigative  departments  are  not  covered. 

A  Senate  bill  S.1840,  introduced  in  1975  to  amend  the  Fair  Credit  Reporting  Act, 
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would  end  these  exceptions.        It  would  require  that  consumers  be  given  visual 
access  to  their  files  as  well  as  summaries  of  their  contents;     it  would  specifically 
give  consumers  the  right  to  the  medical  information  in  their  files;  it  would  disclose 
the  sources  of  investigative  reports,  whether  in-house  or  by  a  company  such  as 
Retail  Credit;     it  would  provide  advance  notice  to  consumers  that  a, report  is  being 
made  on  them  for  employment  purposes,  and  it  would  notify  consumers  at  the  time  an 
investigative  file  is  opened  on  them. 
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The  amended  act  would  require  specific  consent,  rather  thsin  blanket  consent, 
for  the  release  of  medical  information,  including  a  notice  on  the  consent  form 
that  the  material  will  be  sought  and  kept  by  organizations  like  Retail  Credit  as 
well  as  the  insurance  company  requesting  the  information.     The  proposed  bill 
would  also  give  the  Federal  Trade  Commission  the  power  to  prohibit  investigative 
reporting  companies  from  setting  quotas  for  derogatory  information. 

The  number  of  complaints  about  lack  of  access  to  service  payers'  records  has 
not  been  high,  in  part  because  policyholders  seldom  learn  of  inaccuracies  in  their 
records.     It  is  also  because — although  they  have  signed  broad  release  forms  both 
as  patients  and  as  applicants — the  policyholder  is  usually  unaware  of  who  precisely 
gets  his  medical  information,  and  how  much  detail  is  in  the  medical  records  that 
are  transmitted  to  service  payers. 

Confidentiality ;     The  major  issues  in  service  payment  concern  the 
confidentiality  of  personal  medical  data.     Most  of  these  arise  because  of 
ambiguities  in  the  ethical  and  legal  rules  governing  disclosure  of  medical  data  to 
employers  or  government  health  funders. 

There  are  many  incidents  in  which  sensitive  medical  conditions  of  individuals 
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were  disclosed  to  employers  by  health  insurance  firms.        Sometimes  this  was  done 
directly,  on  the  assumption  that  employers  were  entitled  to  know  because  they  paid 
all  or  part  of  the  premium.     Sometimes  disclosure  took  place  through  the  way  that 
initial  claims  processing  was  handled  by  the  employers,  as  when  an  employee's 
supervisor  had  to  sign  claims  submitted  to  the  firm's  insurance  carrier;  or  when  a 
medical  claims  unit  in  the  personnel  department  considered  it  appropriate  to  inform 
management  of  certain  medical  conditions  being  claimed  (psychiatric  treatment,  for 
example.)     There  are  instances  of  private  companies  doing  work  that  requires 
Defense  Department  clearances  for  employees  passing  on  to  the  government  information 
derived  from  medical  claims  that  employees  were  receiving  psychiatric  care,  on  the 
assumption  that  this  might  affect  the  continuation  of  the  employee's  security 
clearance . 

Dr.  Maurice  Grossman,  Clinical  Professor  of  Psychiatry  at  Stanford  Medical 

School,  and  chairman  of  the  American  Psychiatric  Association's  Task  Force  on 

Confidentiality,  has  compiled  a  set  of  case  incidents  from  the  psychiatric  area 

Ik 

illustrating  these  leakages.    Among  them  are  the  following  three  examples « 

1.  "A  patient,  the  wife  of  an  employee  covered  by  a  group  contract  required 
intensive  treatment  because  of  extreme  emotional  decompensation. . .When  her  husband 
filed  a  claim  for  the  cost  of  treatment,  he  was  told  that  the  employer  would  be 
informed  of  the  claim  and  would  be  required  to  increase  premium  payments  on  all 
employees .. .The  physician  was  dissuaded  from  following  up  on  the  case  by  both 

the  husband  and  the  wife  for  fear  that  the  husband  would  lose  his  job.     The  patient 
became  worse . " 

2.  "A  schizophrenic  patient  received  electric  shock  treatment  in  a  hospital 
and  was  able  to  return  to  work.     The  patient  was  not  told  the  actual  diagnosis 
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because  she  was  still  in  a  fragile  state... The  hospital  sent  a  report  of  the 
hospitalization,  including  the  diagnosis  of  schizophrenia  and  an  account  of  a 
suicide  attempt  to  the  insurance  company .. .which   [in  turn  sent  it]  to  the  employer 
under  a  group  contract  coverage.  Back  at  work,  the  patient  found... that  her 
fellow  employees  knew  all  about  her  illness.   [She]  became  paranoid  toward  her 
physician  and  terminated  treatment." 

3.   "A. . .psychiatric  patient  inquired  from  the  insurance  company  whether 

information  would  reach  the  employer  and  was  assured  it  would  not.     The  entire 

therapy  was  damaged  and  the  patient  became  worse  when  the  employer  disclosed 

knowledge  of  the  treatment  and  other  factors.     The  Medical  Director  of  the 

National   [insurance]  company  involved. . .wrote i    'We  are  obligated  to  tell  the 

employer  because  he  pays  the  premiums.'" 

In  the  summeiry  of  the  Blue  Cross  claims  review  process,  it  was  noted  that 

mental  and  nervous  conditions  were  usually  not  approved  at  Level  One,  and  that  at 

the  Level  Two  and  Three  stages,  the  company  generally  called  for  further  medical 

information,  sometimes  including  the  patient's  entire  medical  record.     This  project 

received  half  a  dozen  letters  from  doctors  concerned  about  such  demajids  for  detailed 

data  in  insurance  claims  processing.     One  was  from  Dr.  Wilson  C.  Rippy,Jr.,  a 
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Tampa,  Florida  psychiatrist.  ^ 

"My  practice  of  child  psychiatry  is  somewhat  different  than  other  practitioners 
...As  a  result  of  this,  my  profile  as  it  comes  out  of  the  computer  for  Blue  Cross 
of  Florida  is  quite  different  from  others. . .Despite  extensive  correspondence  with 
[Blue  Cross]  ajid  many  invitations  to  visit  and  view  the  program  first  hand...  [t]hey 
have  continued  to  misunderstand  and  it  sounds  as  if  they  suspect  the  situation  as 
being  somehow  improper." 

"In  December,  1973,  they  requested  photocopies  of  the  complete  medical  records 
[of  24  children's  cases],     I... wondered  with  them  if  they  would  really  like  to  have 
their  psychiatrists  photograph  their  charts  and  send  them  off  out  of  town  to  an 
insurance  company.     I  offered  to  bring  the  charts  personally  and  turn  them  over  to 
another  physician  or  group  of  physicians ...  and  then  bring  the  charts  back  with  me 
at  the  end  of  the  review." 

Dr.  Rippy  explains  that  such  a  physician  review  was  ultimately  arranged  in 
this  particular  case,  but  adds: 

"I  should  point  out,  however,  that  hospital  records  of  patients  in  the  past 
have  been  photographed  in  their  entirety,  sometimes  without  my  knowledge,  and  sent 
to  Blue  Cross.     What  eventually  happens  to  these  records,  I  have  no  way  of  knowing. 
In  view  of  this,  I  have  become  increasingly  apprehensive  about  what  I  dictate  into 
the  hospital  chart,  which  of  course  compromises  the  chart  and  makes  it  difficult 
for  committees  made  up  of  child  psychiatrists  to  get  an  in-depth  study  of  the 
patient... I  really  doubt  whether  agencies  or  institutions  other  than  physicians 
need  the  details  within  the  medical  chart  and  continue  to  wonder  why  they  have 
access  to  them.     I  find  my  patients  are  aware  of  this  and  apprehensive  about  telling 
me  things... and  I  cannot  really  reassure  them  that  the  chart  will  not  be  copied  or 
that  the  information  somehow  will  not  get  out." 
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A  similar  letter  came  from  Dr.  C.  Brandon  Quails,  Associate  Director  of  the 
Health  Team  Study  Group  at  Stanford  University  Medical  Center  in  Calif ornia. '''^ 
He  wrote : 

"Enclosed  is  a  copy  of  a  recent  communication  from  an  insurance  company, 
in  which  they  asked  to  film  our  medical  records.     One  of  our  patients  had  signed 
a  standard  release  of  information  form  used  by  insurance  companies  and  subsequently 
a  representative  of  Micro-Reproduction  Services  visited  our  offices  to  microfilm 
all  the  patient's  records.     Needless  to  say,  we  refused  such  access... The 
representative  was  not  easily  put  off  and  tried  to  pressure  one  of  our  staff  for 
access  to  the  patient's  file.     We  subsequently  contacted  the  patient  and  explained 
what  had  happened.     The  patient  was  quite  surprised,  because  he  had  no  idea  he 
was  granting  complete  access  to  his  medical  file  as  part  of  his  application... 
and  he  was  much  relieved  that  we  had  not  divulged  any  information..." 

"More  generally,  we  strenuously  object  to  the  wholesale  reproduction  and 
release  of  patients'  files.     Since  we  are  a  psychiatric  clinic,  this  kind  of  request 
is  a  double  affront  to  us,  given  the  sensitive  nature  of  the  information  imparted 
to  us  by  our  patients.    We  strongly  feel  that  third  parties  should  have  access  to 
the  minimum  amount  of  information  necessary  to  complete  their  services,  rather 
than  to  the  maximum  amount  of  information..." 

Because  doctors  and  patients  have  these  concerns  about  the  details  of  medical 

conditions  being  sent  to  service  payers,  individuals  entitled  to  reimbursement 

sometimes  do  not  file  claims  when  socially  stigmatized  conditions  are  present.  It 

has  been  reported  that  many  women  are  not  submitting  insurance  claims  for  abortions 

even  though  these  are  now  legal.    As  one  observer  explained:     "Social  acceptance  of 

abortion  is  still  mixed,  and  even  those  who  support  the  principle  of  the  right  to 

choose  may  be  less  supportive  to  immediate  associates  undergoing  abortion.    At  any 

rate,  the  woman  patient  may  not  wish  to  put  work-based  relationships  to  this  test; 
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even  employment  may  be  perceived  as  being  m  jeopardy." 

A  similar  situation  has  been  reported  with  regard  to  claims  for  psychiatric 
treatment.     Benjamin  Lipson,  an  insurance  underwriter  in  Boston,  whose  firm 
specializes  in  placing  "difficult"  risks,  has  conducted  surveys  and  studies  of  the 
effects  that  current  health  and  life  insurance  practices  have  on  individuals.  In 
a  recent  speech  on  "Psychiatry  and  Underwriting,"    Lipson  declared: 

"Gun-shy  is  one  way  to  describe  the  psychiatric  patient  who  pays  for  benefits 
normally  covered  by  his  health  insurance  because  he  is  frightened  of  a  breach  of 
confidentiality.     A  Maryland  psychiatrist  reported    recently,  for  instance,  that  in 
the  six  years  from  I968  through  1973 1  patients  of  his  having  Federal  Employees 
Health  Benefits  Insurance  with  Blue  Cross  paid  amounts  ranging  from  $11,950  in  one 
year  to  $13,500  in  another  year  for  psychiatric  care  that  otherwise  would  be 
covered  or  defrayed  by  their  insurance.     In  197^»  during  only  the  first  ten  months, 
the  figure  for  this  one  psychiatrist's  patients  came  to  $18,^00.     The  doctor 
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estimated  that  in  the  past  ten  years,  his  patients  paid  at  least  $150,000  out  of 
their  own  pockets  needlessly.    And  these  are  not  isolated  cases." 

In  response  to  the  mounting  concern  about  the  confidentiality  of  service  payers' 

medical  records,  some  of  them  have  begun  to  re-evaluate  their  procedures.  The 

National  Association  of  Blue  Shield  Plans,  for  instance,  adopted  a  formal  policy  on 
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"Guidelines  on  Preserving  Confidentiality  of  Medical  Records"  m  September,  1975. 
The  guidelines  warn  of  "the  potential  threat  of  indiscriminate  access  to,  ajid 
releasing  of,  sensitive  patient  data."    Medical  information  should  not  be  released 
without  a  court  order  and  when  there  is  a  court  order,  Blue  Shield  "should  release 
only  the  specific  information  requested."    Medical  information  used  for  research 
or  utilization  reviews  must  not  "identify  the  patient,  subscriber  or  physician." 
The  guidelines  call  for  restricting  access  to  "the  least  number  of  people  necessary" 
within  the  Blue  Shield  organization,  and  for  orientation  and  training  programs  which 
emphasize  the  sensitivity  of  medical  records  and  the  need  to  maintain  their 
integrity.     Perhaps  most  important: 

"Plan  employees  should  seek  only  those  data  necessary  to  adjudicate  a  claim, 
case  or  utilization  patterns,  and  profiles.     For  example,  if  the  Plan  needs  only  a 
discharge  summary  or  consultation  report,  it  should  not  ask  the  hospital  or 
physician  for  the  entire  record.     To  do  so  not  only  creates  storage  problems,  but 
also  places  unnecessary  burdens  on  those  mechanisms  which  are  meant  to  insure 
confidentiality. " 

Government  Programs; 

Almost  all  of  the  21  million  Americans  over  65  are  covered  under  one  or  both 
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of  the  Medicare  programs.        More  than  half  of  these  have  supplementary  private 
insurance  as  well.     Medicaid  provides  some  medical  expense  coverage  for  millions 
of  low-income  patients.    Each  year,  social  security  disability  payments  go  to  more 
than  three  million  workers.     HEW  also  provides  funding,  on  a  partly  matching  basis 
with  the  states,  for  a  broad  variety  of  special  health  services:     for  children, 
the  mentally  retarded  and  blind,  the  emotionally  disturbed,  the  physically 
handicapped,  alcoholics,  and  drug  addicts.     In  addition  more  than  60  million  full- 
time  workers  are  covered  under  Workmen's  Compensation  laws. 

For  those  over  65  who  are  covered  by  Medicare,  once  eligibility  of  age  has 
been  established,  the  program  does  not  need  to  collect  information  on  whether  an 
individual  is  a  poor  health  risk  or  a  poor  financial  risk.     The  government's  major 
concern  is  to  make  sure  that  the  medical  procedures  it  is  paying  for  are  in  fact 
performed,  and  if  performed,  are  necessary  in  terms  of  sound  medical  practice. 
This  concern  for  fraud  is  directed  not  at  the  patient,  but  at  the  doctor  or 
hospital  being  reimbursed.     Misuse  and  fraud  by  doctors  and  health  care  providers 
running  into  the  millions  of  dollars  is  often  cited  as  a  chief  reason  for  the 
astronomical  costs  of  government  funded  medical  programs.     Thus,  government  programs 
use  the  patient's  medical  record  for  utilization  review  and  quality  care  assurance. 
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which  will  be  discussed  shortly. 

Medicaid  and  several  of  the  special  health  programs  listed  above  require  the 

establishment  of  finamcial  need  by  participants.     A  new  amendment  to  the  Social 
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Security  Act,  Title  XX,  went  into  effect  in  October,  1975'        It  requires  the  states 
to  scrutinize  closely  the  eligibility  of  paxticipants  in  the  Aid  to  Families  with 
Dependent  Children  Program,  and  the  Supplementary  Security  Income  Program  (the  aged 
and  the  blind) .     State  administrators  are  encouraged  to  cross-check  these  two 
categories  against  the  records  of  individuals  in  other  government  programs  such  as 
Medicaid  or  state-supported  correction  services.     Thus,  for  example,  the 
administrator  of  a  program  for  crippled  children  might  check  the  eligibility  of  a 
particular  child  by  checking  the  records  of  the  juvenile  justice  system  to  make  sure 
that  the  information  on  the  latter  record  is  the  same  as  on  the  application  for  aid 
for  the  handicapped  child. 

The  states  may  also  check  eligibility  through  other  sources.     In  Connecticut, 
for  example,  the  applicant's  income  documentation  is  checked  with  the  records  of 
the  Connecticut  Department  of  Labor,  which  collects  a  quajrterly  report  on  wages 
from  each  employer.     But  more  than  income  documentation  is  required  to  participate 
in  the  medical  benefits  of  these  programs.     Form  W-2000  of  the  Connecticut 
Department  of  Social  Services  requests  name,  address.  Social  Security  number,  date 
of  birth,  ethnic,  educational,  religious  and  marital  data.    Applicants  are  not  told 
that  beyond  identifying  name,  address  and  Social  Security  number,  and  income 
information,  the  other  data  are  optional  and  not  required  by  federal  regulations. 
Nor  are  they  told  how  this  information  will  be  used. 

Most  state  and  federal  programs  monitor  medical  aid  to  detect  fraud,  or  as 

President  Ford  put  it  when  Title  XX  was  signed  into  law,   "to  get  the  chiselers  off 

welfare."    At  least  one  government  agency  disbursing  medical  aid  funds  went  far 

beyond  this:     Under  the  California  Short-Doyle  Act,  county  health  departments 

disburse  supplemental  funds  to  psychiatric  clinics  on  behalf  of  those  patients  who 
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cannot  afford  private  practitioners.        The  Marin  County  Depairtment  of  Health 
Services  demanded  that  psychiatric  clinics  receiving  these  funds  supply  an  analysis 
of  each  patient's  problems,  including  the  patient's  living  situation,  whether  he  or 
she  had  difficulty  in  social  relations,  and  answers  to  questions  about  therapy  such 
as  "What  does  patient  expect  to  gain  from  therapy?    What  is  patient  willing  to 
change?    What  is  patient  willing  to  undergo  to  bring  about  change?" 

Although  the  California  Short-Doyle  Act  required  no  such  information,  the 
Marin  County  Department  of  Health  Services  told  the  county  psychiatric  clinics  that 
it  would  withhold  the  funds  if  the  questionnaires  were  not  completed  and  returned. 
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UTILIZATION  REVIEWS  AND  QUALITY  CARE  ASSURANCE 


Utilization  review  is  a  system  by  which  hospitals  and  outside  monitoring 
agencies  attempt  to  determine  how  the  hospital's  facilities  are  being  used,  so 
that  administrators  may  answer  such  questions  as:     are  the  overall  facilities 
adequate  to  the  patient  load?     are  some  facilities  being  underused  while  others 
are  being  overused;     what  is  the  normal  length  of  hospital  stay  for  a  particular 
illness  or  operation  and  how  do  stays  in  a  specific  hospital  compare  with  these 
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norms;    what  is  the  staff -patient  ratio  and  is  it  higher  or  lower  thaji  the  norm. 
Quality  care  assurance  is  the  related  examination  of  whether  the  treatm.ent 
prescribed  for  the  patient  is  appropriate,  and  whether  the  actual  delivery  of  that 
treatment  is  along  professionally  acceptable  lines.        Both  kinds  of  reviews  are 
needed  by  hospitals  so  that  they  can  plan  the  most  efficient  use  of  their  facilities 
at  the  lowest  costs;  to  service  payers  so  that  they  may  control  the  costs  of 
medical  care;     and  to  patients  so  that  they  may  be  assured  good  quality  medical 
care  under  good  physical  conditions. 

Utilization  and  quality  care  assurance  reviews  are  conducted  on  several  levels 
vhich  sometimes  overlap.     Many  hospitals  conduct  their  own  utilization  reviews. 
Sometimes  they  review  their  internal  operations  alone,  and  sometimes  they  compare 
themselves  to  other  hospitals  so  they  can  adjust  their  own  practices  against  the 
norms . 


A  variety  of  private  statistical  review  services  are  used  by  hospitals  around 
the  country  for  statistical  profiles  against  which  to  compare  their  own  performance. 
The  largest  of  these,  the  Professional  Activity  Service,  has  each  participating 
hospital  extract  50  or  60  items  of  information  from  patient  records  in  order  to 
prepare  its  reports.  ^    The  Service  covers  roughly  2>0fo  of  the  largest  short-term 
general  hospitals,  representing  perhaps  ^3%  of  admissions  and  discharges  in  the 
country.     The  reports  prepared  by  Professional  Activity  Service  and  the  eight  or 
ten  similar  systems  for  hospitals  do  not  contain  identified  patient  information  but 
are  statistical  in  character. 


The  Joint  Commission  on  Accreditation  of  Hospitals  reviews  hospital  performance 
to  make  sure  that  hospitals  meet  certain  standards  in  physical  plant  and  patient- 
staff  ratios;  to  determine  that  patient  records  are  current  and  comprehensible; 
and  to  see  that  correct  procedures  are  followed  as  to  drug  orders,  discharge 
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summaries,  etc. 

State  and  local  agencies  responsible  for  supervising  hospitals  monitor 
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sanitaxy  facilities  and  compliance  with  building,  safety,  and  fire  codes.  Some 
of  them  use  patient  records  to  review  hospital  costs,  medical  procedures  and  length 
of  stay.     The  Public  Health  Service  also  examines  patient  records  for  its  annual 
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Hospital  Discharge  Survey.  Selected  information  is  extracted  from  250,000  patient 
files  in  69O  hospitals  for  this  purpose. 
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Blue  Cross  and  Blue  Shield  set  norms  on  lengths  of  hospital  stay  for  particular 
illnesses  and  procedures,  and  of  the  cost  of  physicians'  services  in  hospitals  for 

given  procedures,  based  on  actuarial  studies  abstracted  from  their  subscribers' 
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records.        Since  the  "Blues"  can  withhold  reimbursement  to  the  hospital  or 
physician  if  they  find  that  the  norms  are  violated  without  good  reason,  this 
constitutes  a  powerful  form  of  utilization  review  ajid  quality  care  assurance. 

Professional  Standards  Review  Organizations 

Since  the  mid-sixties,  federal  and  state  agencies  responsible  for  Medicare  and 

Medicaid  programs  have  required  hospitals  to  perform  several  kinds  of  review, 

including  patient  record  review,  to  justify  the  type  of  care  provided  (e.g.  inpatient 
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vs.  outpatient)  and  the  length  of  time  a  patient  stays  in  the  hospital."^  Fiscal 
intermediaries  for  Medicare  and  Medicaid  (often  Blue  Cross,  Blue  Shield  or  private 
health  insurance  companies)  have  been  conducting  claims  reviews  in  which  the  need 
for  hospital  care  is  evaluated  after  the  fact,  and  a  decision  is  made  on  how  much 
of  a  particular  claim  the  government  will  pay. 

By  the  early  1970's,  the  soaring  costs  of  Medicaid  and  Medicare — in.  some  areas 
hundreds  of  millions  of  dollars  more  than  was  originally  estimated — led  Congress  to 
create  a  special  structure  for  reviewing  the  costs  of  medical  care  under  these  two 
programs.  This  was   the  genesis  of  the  Professional  Standards  Review  Organizations 
(PSRO),  brought  into  being  by  Title  XI  of  the  Social  Security  Act  in  1972  (Public 
Law  92-603).        The  PSROs  are  designed  to  detect  fraud  and  misuse  of  facilities  by 
health  care  providers — physicians  and  hospitals — and  to  assure  that  proper  standards 
of  care  are  secured  under  public  funds. 

The  format  of  the  PSROs — physician-staffed  and  physician-directed  commissions 

under  the  aegis  of  state  Medical  societies — was  suggested  by  the  American  Medical 

Association  as  a  counter-proposal  to  head  off  monitoring  of  medical  care  by 

government  officials,  especially  non-medical  personnel.    Even  though  the  medical 

profession  controls  this  policing  function,  some  physicians'  groups  and  hospital 

organizations  sought  to  enjoin  the  operation  of  the  PSROs  as  an  unnecesssiry 
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government  interference  with  the  practice  of  medicine.-^  In  November,  1975»  the 
Supreme  Court  rejected  this  argument,  and  the  PSROs  are  expected  to  become  fully 
operational  by  1976,  as  originally  scheduled  in  the  legislation. 

Under  the  legislation,  the  Secretary  of  HEW  is  authorized  to  designate  206 
PSRO  districts  throughout  the  country,  by  January  1,  1976,  and  to  establish 
"conditional  contracts"  with  "a  qualified  organization" — that  is,  a  non-profit 
professional  association  which  represents  a  substantial  proportion  of  the  physicians 
in  each  area.     These  bodies  are  to  set  up  the  machinery  for  and  to  administer  the 
program.     If  no  non-profit  association  applies,  HEW  is  empowered  to  contract  with 
any  other  organization,  a  hospital,  for  example,  to  administer  the  program  in  a 
given  area. 
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The  PSROs  initial  function  is  to  provide  utilization  review  of  hospital 
services,  first  by  pre-certifying  the  particular  hospitals  for  Medicaid  and 
Medicare  patients,  and  then  by  regular  re-certification.     They  must  also  review 
the  quality  of  care  within  the  institution,  making  judgments  as  to  whether  particular 
procedures  or  tests  or  operations  are  warranted  for  the  conditions  specified,  and 
determining  whether  the  procedures  warranted  were  in  fact  delivered.     Ultimately,  it 
is  contemplated  that  PSROs  will  review  all  government-supported  institutional 
care:    mental  health  facilities,  skilled  nursing  facilities  and  intermediate  care 
facilities.     They  may  some  day  review  non-institutional  care  supported  by  the 
government,  including  outpatient  clinics  and  medical  home  visits. 

Exactly  how  the  PSROs  are  to  conduct  reviews  in  each  area  is  left  f  lexible . -^-^ 
Where  a  hospital  has  evidenced  its  capability  and  desire  to  run  its  own  review 
program,  the  PSRO  can  contract  with  the  hospital  to  do  so, and  in  this  case,  the 
PSRO  will  monitor  the  monitor.     Where  a  hospital  is  not  qualified  or  willing  to  do 
its  own  review,  PSRO  may  either  assemble  a  professional  staff  to  perform  the  review, 
or  it  can  delegate  this  duty  on  some  other  basis. 

The  legislation  creates  a  Professional  Standards  Review  Council  in  each  state 
which  has  more  than  three  local  PSROs.     (Massachusetts,  for  instance,  has  five  local 
districts).     This  state  Council  will  be  composed  of  one  representative  from  each 
local  PSRO,  four  physicians,  and  four  laymen    selected  by  the  HEW  Secretary  as 
public  representatives.     Two  of  the  latter  are  to  be  recommended  by  the  State 
governor.     The  State  Council  will  review  the  local  PSRO  performance.     Over  the 
state  Councils  is  a  National  Peer  Standard  Review  Council,  consisting  of  11 
physicians  appointed  by  the  Secretary  of  HEW  which  reports  to  HEW  and  the  Congress 
on  how  the  whole  program  is  working. 

While  specific  administrative  arrangements  may  differ  considerably  from  one 
PSRO  to  another,  an  example  from  a  Northeastern    PSRO  may  be  generally  illustrative. 
This  organization  covers  1,400  physicians  and  osteopaths,  and  22,000  Medicaid  and 
Medicare  hospital  admissions  each  year. 

Most  of  the  hospitals  in  this  region  will  be  allowed  to  do  their  own 
certification  and  length  of  stay  reviews.     Specially  trained  nurses  extract  the 
patient  data  needed  for  certification  forms.     If  the  admission  of  a  particular 
patient  is  certified,  a  projected  length  of  stay  will  be  decided  upon,  and  the 
patient  and  the  physician  will  be  told  that  expenses  will  not  be  paid  for  beyond 
that  length  of  time  unless  the  case  is  examined  at  a  later  time  and  re-certified. 
Copies  of  the  certification  forms  go  into  the  patient's  file  and  to  the  PSRO. 
Difficult  cases  are  referred  to  PSRO  physicians  for  decision. 

When  the  patient  is  discharged,  medical  record  technicians  may  extract 
information  for  a  discharge  summeiry,  a  copy  of  which  will  be  sent  to  PSRO.  Working 
from  this  information,  and  occasionally  from  additional  patient  file  information 
from  the  hospital,  the  PSRO  will  do  medical  evaluation  studies  and  maintain  profiles 
on  patients,  physicians  and  institutions. 
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According  to  the  director  of  this  PSRO,  it  is  not  yet  clear  exactly  how  the 
patient  and  physician  profiles  will  be  used,  although  it  is  assumed  that  physicians 
will  be  alerted  if  their  practices  depart  substajitially  from  those  of  other 
physicians  in  their  region,  as  for  example,  how  frequently  they  perform  surgery 
for  a  given  condition.     One  of  the  considerations  here,  according  to  the  director, 
will  be  to  "avoid  stigmatizing  individual  physicians  among  their  colleagues  by 
directing  most  of  the  educational  efforts  at  the  entire  staff  of  the  hospital." 

Since  the  PSROs  are  not  yet  fully  operational,  several  aspects  about  their 

role  are  still  to  be  developed.     There  are  conflicting  opinions  about  when  and  if 

the  PSROs  will  eventually  replace  totally  the  present  Medicaid  and  Medicare 

evaluation  programs,  some  of  which,  as  noted  earlier,  are  now  conducted  by  a 
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variety  of  fiscal  intermediaries.        Nor  is  it  established  exactly  what  kinds  of 
materials  the  PSROs  will  collect  for  their  reviews,  what  sort  of  patient  record 
review  will  become  standardized ,  and  whether  or  not  the  PSRO  will  virtually  compel 
the  creation  of  state-wide  or  regional  data  banks. 


CONCLUSIONS 

This  chapter  has  highlighted  several  features  of  record-keeping  and  data  use 
in  Zone  II.     The  personal  medical  data  used  by  service  payers  ajid  care  reviewers 
does  not  come  directly  from  patients  but  from  the  records  compiled  and  maintained 
by  primary  care  providers.     As  a  practical  matter,  general  consent  forms  and  the 
legal  doctrine  of  implied  consent  result  in  the  patient  unknowingly  surrendering 
control  over  what  is  furnished  to  Zone  II  organizations  and  how  it  is  used. 

Within  the  past  year  or  two,  medical  spokesmen  and  civil  liberties  groups  have 
voiced  concern  about  the  broad  scope  of  Zone  II  demands  for  patient  information. 
Among  the  questions  they  have  raised  are i    Whether  the  amount  of  detail  sought  is 
necessary  for  the  functions  performed;     whether  the  data  is  adequately  secured 
against  unauthorized  third  party  access;     and  what  the  justifiction  is  for  retaining 
patient  data  for  long  periods  in  identified  form. 

These  concerns  have  begun  to  create  a  reconsideration  of  Zone  II  needs  and 
practices  among  insurers  and  care  reviewers  themselves  as  well  as  medical  societies 
and  various  government  agencies.     Among  the  possibilities  being  explored  are 
whether  removal  of  patient  identifiers  from  many  of  the  payment  or  review  processes 
is  desirable  to  minimize  the  dangers  of  improper  disclosure;    whether  notification 
to  patients  of  how  insurers  process  their  claim  data  should  be  required,  with  rights 
of  access  provided  when  the  patient  requests  it;     and  whether  there  are  ways  of 
lessening  the  amount  of  personal  data  required  for  sensitive  Zone  II  activities  such 
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as  payment  for  psychiatric  treatment  or  stigmatizing  physical  conditions. 

It  should  be  underscored  that  what  is  being  re-examined  is  the  procedure  for 
protecting,  and  limiting  the  information  supplied,  and  not  the  fundamental  idea  that 
there  is  a  legitimate  need  in  Zone  II  for  identified  patient  information.     It  is 
almost  universally  accepted  that  any  health  care  system  — whether  public  or  private 
or  a  mixture  of  the  two — must  know  who  the  patients  are  in  order  both  to  pay  for 
their  care  and  to  guarantee  that  this  care  meets  professional  standards  at  a 
reasonable  cost. 
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CHAPTER  3.     ZONE  III  -  SECONDARY  USERS  OF  PERSONAL  MEDICAL  DATA 


This  chapter  traces  how  secondary  users  of  personal  medical  data  -  organizations 
not  directly  providing  health  care,  paying  for  it,  or  assuring  its  proper  delivery  - 
obtain  such  information  for  various  business  or  governmental  purposes,  and  how  they 
use  it  once  they  get  it.    As  we  noted  earlier,  the  outward  flow  of  medical  data 
into  Zone  III  has  enormous  impact  on  people's  lives.     It  affects  decisions  on 
whether  they  are  hired  or  fired,  whether  they  can  secure  business  licenses  and  life 
insurance;  whether  they  are  permitted  to  drive  cars,  whether  they  are  placed  under 
police  surveillance  or  labelled  as  security  risks,  or  even  whether  they  caji  get 
nominated  for  and  elected  to  political  office.    Each  of  these  decisions — and  many 
more — involves  a  balancing  of  the  individual's  claim  to  privacy  with  other  societal 
goals.     The  survey  that  follows  catalogs  existing  practices,  and  also  notes  the 
continuing  re-evaluation  of  these  competing  values  that  has  taken  place  over  the 
years,  especially  during  the  past  decade  of  major  changes  in  social  and  political 
values  in  the  United  States. 

CREDENTIAL  AND  EVALUATIVE  DECISIONS 

Life  Insurance 

The  decision-making  process  in  life  insurance  underwriting  resembles  that  in 
health  insurance.    Approximately  2kfo  of  the  life  insurance  policies  in  force  in 
1972  were  on  a  group  basis  and  required  no  health  information  from  the  applicant.^ 
Still  others  are  called  "non-medical"  because  no  physical  examination  is  required. 
Many  companies  write  insurance  for  younger  people  for  up  to  $30,000  without 
requiring  either  a  medical  examination  or  ordering  a  Retail  Credit  report.  "Non- 
medical" may  be  a  misleading  term,  however,  since  companies  do  assess  the  health 
information  provided  on  the  application  form,  and  may  order  a  check  with  the 
Medical  Information  Bureau,  an  industry -run  medical  information  pool. 

Since  the  Medical  Information  Bureau  (MIB)  is  the  chief  source  of  the  life 

insurance  industry's  health  information,  a  brief  expleination  of  its  operation  may  be 
2 

helpful.      MIB  was  established  in  I909  by  large  msurgince  companies  for  the  purpose 
of  supplying  medical  reports  about  insurance  applicants  to  its  700  member  life 
insurance  companies. 

These  member  insurance  companies  are  the  source  of  the  raw  data  from  which 
MIB  compiles  its  final  reports.     The  reports  to  MIB  draw  on  the  life  insurance 
companies'  sources  of  information,  such  as  applications,  physicians'  and  hospital 
records,  and  previous  claims.     When  an  "insurance  related"  medical  condition  is 
noted,  it  is  passed  on  to  MIB  throu^  a  system  of  more  than  300  separate  codes 
which  can  produce  a  general  picture  of  the  applicant.     Family  history  codes  permit 
the  listing  of  hereditary  diseases,  TB,  smd  mental  disorders  in  the  applicant's 
family.     Blindness  and  other  permanent  disabilities  are  covered  by  other  codes. 
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as  are  all  major  infectious  diseases,  alcoholism,  drug  dependency  gmd  injuries. 
Until  recently,  codes  for  "reckless  driving,"  sexual  deviance  and  social 
maladjustments  were  included,  as  well  as  codes  about  finemcial  condition  and 
participation  in  hazardous  sports.     MIB  no  longer  requires  member  firms  to  report 
information  under  these  codes.     MIB  officials  state  that  "all  reports  to  the  MIB 
are  automatically  expunged  seven  years  after  the  date  they  are  reported.     In  this 
way,  reports  made  in  the  distant  past  are  no  longer  available  for  underwriting 
purposes,  and  a  mechanism  is  provided  for  a  person  to  start  afresh  with  a  clean 
slate." 

A  typical  Medical  Information  Bureau  report  might  look  like  this:  "11AG39  INDj 
Drj A  14AP72;    258ZMC-3^0."    Prom  these  codes,  the  insurer  can  tell  that  this 
individual,  a  physician  living  in  Indiana,  was  born  on  August  11,  1939 i  and  that  a 
report  was  received  from  a  medical  source  on  April  14,  1972  that  he  had  a 
psychoneurotic  disorder,  with  two  or  more  episodes  of  this  problem  within  the  last 
five  years.     The  report  also  shows  that  his  cardiogram  is  normal.     Had  it  not  been 
normal,  specific  values  would  have  been  reported.     If  there  had  been  psychosomatic 
complications  accompanying  the  psychiatric  problem,  these  would  have  been  noted. 

MIB  maintains  files  on  11  million  individuals.    In  1971?  the  Bureau  handled 
19  million  requests  for  information,  returning  over  500,000  reports  with  adverse 
medical  or  other  information  (a  little  over  5%).     Member  insurance  companies  paid 
$9  million  for  these  reports  in  1971,  and  sent  2.2  million  coded  reports  to  MIB 
describing  the  health  problems  of  applicants,  or  in  the  case  of  some  health  insurance 
firms,  claimants,  too. 

In  1974,  MIB  adopted  new  rules  to  bring  it  into  conformity  with  the  Fair  Credit 
Reporting  Act.^    The  Insurance  applicant  is  now  told  by  the  insurance  company 
that  some  of  the  information  gathered  about  him  may  be  submitted  to  the  r»:iB. 
Member  life  insurance  companies  are  also  required  to  obtain  authorization  from  the 
applicant  before  the  company  is  permitted  to  query  the  MIB  computer.  Applicants 
are  told  that  they  may  have  access  to  the  information  about  them,  and  that  any 
inaccuracies  can  be  corrected.     When  a  request  for  access  is  received,  MIB  arranges 
for  the  company  that  made  the  report  to  send  the  information  to  the  applicant  or 
policyholder.     Medical  information  is  not  sent  directly  to  the  applicant,  but  to 
his  physician. 

For  deciding  about  larger  policies  or  applications  from  older  people,  the  full 
range  of  information  sources  may  be  used.     In  1972,  almost  8  million  investigative 
reports  were  completed  for  life  underwriting  by  Retail  Credit,  Hooper-Holmes  and 
the  American  Service  Bureau.^    One  review  of  life  underwriting  procedures  indicates 
that  firms  do  not  check  hospital  records  very  often,  even  when  they  have  a  release 
from  the  patient,  because  it  is  expensive  to  do  so. 
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In  1972,  almost  85?^  of  life  insurance  applications  were  approved  at  standard 
rates. ^    Of  the  500,000  applications  denied  that  year,  90?^  were  turned  down  for 
health  reasons.     Roughly  4%  were  approved  but  the  policyholder  had  to  pay  higher 
rates  for  the  following  reasons:     heart  disease,  35?^ J  weight  problems,  1??^;  other 
medical  reasons,  29^;  occupation,  9%;  other  reasons,  10%. 

It  is  worth  noting  that  very  little  use  is  made  within  insurance  companies 
themselves  of  the  information  gathered  during  the  underwriting  process.  Lawrence 
Ross  suggests  that  relatively  little  information  moves  from  one  line,  say  life 
insurance,  to  another,  say  health  insurance,  within  the  same  firm.^    But  both  medical 
hearsay  and  reliable  medical  reports  are  used  outside  the  insuring  firm  once  the 
underwriting  process  is  completed.     Life  insurance  companies  pass  on  to  the  Medical 
Information  Bureau,  in  the  form  of  general  codes,  adverse  information  about 
applicants  received  from  Retail  Credit,  other  companies,  physician  statements  and 
medical  examinations. 

Automobile  Insurance 

One  feature  of  auto  insurance  is  distinctive ;     all  states  require  individuals 
who  own  cars  to  carry  liability  insurajice .     Mandatory  insurance  requirements  have 
resulted  in  a  complex  system  of  "assigned  risks"  under  which  everyone  is  supposed  to 
be  guaranteed  at  least  the  minimum  level  of  personal  liability  coverage,  but  at 

n 

higher  rates.'     A  study  conducted  in  197^  by  the  Federal  Insurance  Administration 
of  the  Department  of  Housing  and  Urban  Development  showed  that  in  spite  of  the 
mandatory  insurance  requirement,  at  the  latest  count  (I967),  20%  of  the  nation's 
drivers  were  still  not  covered  by  any  insurance.      Furthermore,  of  the  four  million 
drivers  in  "assigned  risk"  state  pools,  who  pay  almost  twice  as  much  for  automobile 
liability  insurance,  3.3  million  were  "clean"  risks — that  is,  they  had  not  had  an 
accident  within  three  years.     Of  these,  2.7  million  had  neither  had  an  accident  nor 
a  driving  violation  on  their  records  within  three  years.     The  study  gives  no  reasons 
why  apparently  low-risk  individuals  are  refused  conventional  insurance,  but  George 
K.  Bernstein,  Federal  Insurance  Administrator,  offered  some  possible  explanations: 

"Applicants  might  be  refused  because  a  company  does  not  want  to 
write  any  more  insurance  in  a  certain  area.     Perhaps  the  company  does 
not  want  to  give  an  agency  any  more  business.     Maybe  the  applicant  has 
been  reported  to  keep  a  messy  house.     Or  perhaps  an  individual  lives  in 
the  wrong  neighborhood."  9 

While  relatively  little  has  been' written  about  automobile  insurance  underwriting, 
it  appears  that  health  information  plays  some  role  in  determining  what  rate  an 
individual  pays.     Whether  an  individual  is  placed  in  an  assigned  risk  pool,  for 
example,  may  depend  on  a  disability  which  might  impair  driving,  or  on  an 
investigative  report  alleging  the  excessive  use  of  alcohol.     The  Federal  Insurance 
Administration  report  notes  one  insurance  plan  in  which  a  family's  premium  would 
increase  by  30?^  if  the  father  "suffered  from  moderately  high  blood  pressure." 
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other  factors,  however,  are  more  important  than  health  records,  according  to 

the  FIA's  report:  age,  geographical  location,  race,  claims  history  and  driving 

violations  are  probably  the  most  important  reasons  for  forcing  applicants  into  the 

assigned  risk  category.     The  American  Insurance  Association  reported  that  less  than 

i  of  Ifo  of  its  members'  cancellations  or  non-renewals  in  I968  were  for  health 
10 

reasons . 

A  dramatic  example  of  a  breach  of  confidentiality  of  medical  records  in  an 
accident/casualty  setting  was  revealed  early  in  1976.     In  Denver,  Colorado  indictments 
were  brought  against  Factual  Services  Bureau     (a  27-year  old  private  detective 
agency  with  operations  throughout  the  country),  several  of  its  employees,  and  one 
hospital  employee  for  illegally  obtaining  information  from  hospital  medical  records. 

The  information  was  allegedly  secured  for  casualty  insurance  companies  and 
their  attorneys  for  use  in  challenging  claims  against  the  companies.     The  most 
common  means  of  obtaining  the  information  was  for  a  Factual  Services  Bureau  employee 
to  telephone  a  hospital  pretending  to  be  a  physician  from  another  hospital  who 
needed  the  data  to  treat  the  patient  whose  records  were  on  file.     (One  of  the 
charges  was  criminal  impersonation.)    An  Assistant  District  Attorney  working  on  the 
case  noted  that  it  was  easy  to  obtain  hospital  information  without  authorization 
because  security  procedures  are  geared  to  the  assumption  that  all  inquiries  are 
legitimate,  and  any  person  calling  is  who  he  claims  to  be. 

As  of  March  1976  the  term  of  the  grsind  jury  that  brought  the  indictments  was 

extended  for  two  more  months  and  the  investigation  was  continuing.     In  addition, 

investigations  were  begun  in  other  states  with  the  thought  that  this  may  have  been 

♦ 

a  normal  operational  procedure  for  all  of  the  company's  breinches. 


*  Rocky  Mx?\mtain  News,  Januairy  14.  I976,  p.  kl,  and  telephone  conversations  with 
Denver  Assistant  District  Attorney  Peter  Bernstein,  January  22  and  March  3»  1976. 
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Employment 


To  some  extent,  the  role  of  health  information  in  employment  decisions  follows 
the  law  of  supply  and  demand  in  the  labor  market.     The  more  plentiful  the  labor 
supply,  the  more  rigid  the  health  criteria — along  with  other  criteria — become. 
Similarly,  the  health  standards  that  are  sometimes  set  by  employers  are  often  not 
related  to  their  goals  of  reducing  absenteeism,  increasing  worker  performance,  and 
keeping  group  health  insurance  premiums  low.     They  sometimes  appear  to  be  an 
exercise  in  selectivity  for  the  sake  of  selectivity  itself. 

For  example,  a  Veterans  Administration  poll  of  company  doctors  recently 

discovered  that  not  only  medical  problems  like  TB,  diabetes  and  mental  disorders 

disqualify  many  job  applicants,  but  "even  patients  with  mild  illnesses,  which  may 

11 

not  increase  their  morbidity  or  mortality,  are  being  denied  work.        The  criteria 
used  for  determining  employability  appear  in  some  cases  to  have  little  relation  to 
modern  medical  judgment." 

Discrimination  against  those  who  have  had  psychiatric  care  has  been  a  particular 
focus  of  protest.     The  American  Psychiatric  Association's  Task  Force  on 
Confidentiality  reports  receiving  many  complaints  about  patients  being  denied 

12 

employment  or  promotion  unfairly  because  they  have  had  psychiatric  treatment. 

One  school  system,  they  report,  routinely  denies  employment  to  individuals  who  have 

any  history  of  therapy  or  psychiatric  care.     The  VA  study  mentioned  above  found 

that  75?^  of  the  50  company  physiciains  responding  said  their  firms  would  not  hire 
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a  person  who  "is  currently  under  psychotherapy"  for  any  position)  ^    almost  kOfo 
reported  that  they  would  deny  employment  to  an  applicant  who  had  previously  been 
hospitalized  for  a  mental  illness,  but  was  not  psychotic.     In  a  recent  case  in 
New  Jersey,  an  applicant  for  the  police  department  was  rejected  because  his  military 
record  showed  an  old  psychological  treatment  entry.        The  impact  on  the  job  market 
of  such  restrictive  employment  policies  can  be  gauged  when  it  is  recalled  that 
almost  3  million  people  are  currently  in  psychotherapy,  according  to  a  1975  report 
issued  by  the  National  Institutes  for  Mental  Health. '''■^ 

The  extent  to  which  health  information  is  sought  by  employers — often  at 
considerable  expense — demonstrates  how  important  a  part  it  plays  in  employment 
decisions.     Health  information  may  enter  that  decision-making  process  from  at  least 
six  different  sources:     on  the  application  form,     from  company  and  private 
physicians,     from  investigative  reports  by  firms  such  as  Retail  Credit  and 


64 


government  security  agencies,     from  insurance  claims  or  from  the  insurance  carrier, 
from  contacts  with  previous  employers,     and  from  U.S.  military  separation  papers. 

Majiy  application  forms  demand  information  about  the  general  state  of  the 
applicant's  health  and  whether  or  not  the  applicant  has  ever  suffered  from  a  mental 
disorder,  received  psychiatric  treatment,  drinks,  or  uses  drugs.     Sample  surveys 
conducted  in  1964  and  I965  by  the  National  Industrial  Conference  Board,  a  management 
society,  show  that  more  than  70%  of  the  manufacturing  and  non-manufacturing  firms 
studied  require  a  pre-employment  physical  for  at  least  some  applicants . 

The  federal  government  investigates  many  applicants  through  the  National  Agency 

Checks  and  Investigations  program  of  the  FBI  and  the  use  of  "full  field" 
17 

investigations.        The  full  field  investigation  has  as  one  of  its  goals  the 
assessment  of  "mental  stability,"  smd  investigators  often  interview  school  and 
private  psychiatrists.     While  full  investigations  are  normally  conducted  only  for 
higher  government  posts,  or  in  situations  where  there  are  "national  security" 
concerns,  some  government  agencies  order  them  whenever  they  get  information  that  the 
applicant  has  had  psychotherapy  or  may  be  a  homosexual,  even  though  he  or  she  may  be 
applying  for  a  relatively  insignificant  job.     There  also  have  been  charges  that  if 
an  applicajit  has  had  psychotherapy,  or  is  a  homosexual,  the  job  for  which  he  or  she 
is  applying  may  suddenly  be  reclassified  as  requiring  a  security  clearance,  as  a 
device  for  disqualifying  the  applicant  for  it. 

In  a  report  in  the  American  Journal  of  Psychiatry,  three  psychiatrists  describe 

the  procedures  followed  when  the  government  orders  psychiatric  evaluation  of  an 
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applicant  for  security  clearance. 

"Applicants  are  not  routinely  examined  by  a  psychiatrist.     The  most 
common  reasons  [for  requiring  the  examiniation]  are  that  he  was  once  a 
patient  in  a  mental  hospital,  was  discharged  from  the  armed  forces  because 
of  a  psychiatric  condition,  or  had  been  lender  official  surveillance 
because  of  some  abnormality  of  behavior... 

The  relationship  of  the  applicant  and  the  psychiatrist  is  not 
that  of  patient  and  physiciaji  and  no  traditional  confidentiality  of 
communications  arises.     The  psychiatrist  should  tell  the  applicant 
that  their  relationship  is  not  confidential  and  that  all  information... 
may  be  revealed  to  the  government...   [T]he  interview  and  exajnination 
aire  voluntary.     However,  a  refusal  to  furnish  relevant  data  may  prevent 
any  kind  of  a  final  judgment  on  the  individual,  in  which  event, 
processing  of  the  application  for  clearance  would  be  discontinued." 

A  somewhat  different  set  of  circumstances  arose  in  an  actual  case  in  which  an 

applicant  for  security  clearance  answered  "no"  to  the  question  on  the  application 

19 

formt     "Have  you  ever  suffered  from  mental  illness?"  ^    It  was  subsequently  revealed 
that  some  years  earlier  he  had  seen  a  psychiatrist  for  a  brief  period.  The 
government  claimed  he  had  lied  on  the  form  and  attempted  to  fire  him.     The  applicajit 
claimed  that  visiting  a  psychiatrist  was  not  evidence  of  mental  illness,  and  that 
his  answer  had  been  truthful.     The  government  then  required  him  to  have  a 
psychiatric  examination, to  which  he  agreed,  and  in  addition  to  sign  a  release  which 
would  give  the  government  access  to  the  private  notes  of  the  psychiatrist  who  had 
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treated  him  earlier.  When  he  balked  at  this,  he  was  fired.  Ultimately  the  U.S. 
Court  of  Appeals  upheld  the  government's  right  to  fire  him,  but  remarked  that  the 
government's  practice  of  requiring  access  to  his  private  psychiatrist's  notes  was 
not  a  good  one,  and  suggested  that  the  government  re-think  its  procedures.  - 

As  noted  earlier,  for  many  years  the  U.S.  military  services  included  code 

numbers  on  veterans'  discharge  papers  that  labelled  them  with  any  one  or  more  of  a 
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number  of  derogatory  "medical"  terms.        While  the  Services  have  promised  to  stop 
doing  this,  veterans  must  affirmatively  request  to  have  their  discharge  papers 
changed  to  omit  these  code  numbers.    Since  the  majority  of  veterans  probably  still 
do  not  know  the  meaning  of  the  numbers,  hundreds  of  thousands  of  them  are  carrying 
around  this  adverse  information  and  disseminating  it  to  employers'  files. 

The  insurance  claims  process  also  gives  employers  health  information  on  their 
employees.     This  happens  either  because  insurance  companies  supply  it  directly  to 
the  employer  as  the  payer  of  the  health  insurance  premium,  or  when  the  personnel 
department  of  the  company  actively  monitors  claims. 

In  1970,  the  Retail  Credit  Company  completed  more  than  one  million  reports 
on  job  applicants  and  candidates  for  promotion;  for  these,  investigators  gather 
health  information  from  former  employers,  neighbors,  personal  references  and 
workmen's  compensation  files. 

In  hearings  before  a  House  Committee  in  I968,  Retail  Credit  supplied  a 
fictitious  model  report «    This  noted  that  the  applicant  had  a  period  of  unemployment 
caused  by  a  "mild  nervous  breakdown"  for  which  his  physician  had  recommended  a 
period  of  complete  rest.     Under  the  heading  of  "Health  Habits"  the  report  reads: 

"Mr.  Bowers  has  good  general  health  with  the  exception  of  a  nervous 
disorder  that  has  shown  up  previously  when  he  has  been  under  pressure. 
This  usually  results  in  stomach  discomfort.     His  physician  has  diagnosed 
this  as  'nervous  tension'.     He  has  had  this  condition  for  the  past  15 
years  known.     Subject  has  not  suffered  a  relapse  of  nervous  breakdown, 
however,  he  will  take  medication  prescribed  for  relief  of  tension  when 
he  feels  it  necessary. 

Mr.  Bowers  is  a  social  drinker,  taking  a  maximum  of  2-3  mixed 
drinks  during  any  one  occasion  at  parties  and  when  friends  visit  at 
his  home.     He  has  never  drunk  to  any  degree  of  excess  and  does  not  use 
drugs  other  than  medication  prescribed  for  relief  of  nervous  tension."  22 

The  report  notes  that  the  health -information  was  obtained  from  his  present  and 
a  former  employer  and  "personal  associates." 

Not  all  Retail  Credit  reports  are  as  detailed  as  this  specimen.      Some  may 
use  single  phrases:   "spleen  problems,"  "wife  has  colitis,  nerves,"  "eye  injury," 
to  describe  health  problems  learned  about  from  the  applicant  or  from  an  employer 
or  neighbor. 
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About  80%  of  the  information  in  Retail  Credit  reports  comes  from  the  45  million 
records  stored  in  branch  offices.     Where  the  requested  name  is  not  on  file,  or  the 
material  needs  to  be  updated,  investigators  interview  the  applicajit  and  his  neighbors 
and  employers . 

In  1974,  the  Federal  Trade  Commission  filed  a  complaint  against  Retail  Credit 
sharply  criticizing  some  of  its  investigative  and  reporting  techniques.  Among 
other  things,  the  FTC  charged  thatj 

1.  Retail  Credit  investigators  give  individuals  the  impression  that  they  are 
being  investigated  only  in  connection  with  a  specific  job  application  or  insurance 
application  when,  in  fact,  the  information  about  the  individual  will  be  kept  on 

file  by  Retail  Credit  for  future  reference  by  any  subsequent  customers.  Specifically 
as  to  medical  information,  patients  are  given  the  impression  that  when  they  sign 
authorizations  for  release  of  medical  information,  such  information  is  for  the 
exclusive  use  of  the  insurance  compajiy.     Doctors  and  hospitals  are  also  given  the 
impression  that  Retail  Credit  is  collecting  information  for  that  exclusive  use. 
The  FTC  complaint  states  that  "some  consumers  would  not  have  authorized  the  release 
of  such  confidential  information  had  they  known  it  would  be .. .utilized  by... a 
consumer  reporting  agency." 

2.  Retail  Credit  gives  customers  (insurance  compsmies,  employers,  etc.)  the 
impression  that  its  investigators  have  personally  interviewed  all  of  the  individuals 
listed  as  "sources"  on  their  reports,  and  have  personally  observed  the  home  and 
environment  of  the  individual  being  investigated.     In  fact,  the  FTC  alleged,  much 

of  the  information  is  gathered  over  the  telephone,  and  sometimes  not  even 
telephone  interviews  are  conducted  with  the  listed  sources.     Often  site  visits  are 
not  made,  even  though  the  report  described  the  house  and  neighborhood.  If 
customers  realized  how  superficial  and/or  inaccurate  these  reports  are,  the  FTC 
claims,  they  would  not  rely  on  them  to  deny  employment  or  other  benefits, 

3.  According  to  the  FTC,  certain  procedures  in  the  preparation  of  Retail 
Credit's  investigative  reports  encourage  inaccuracy,  including: 

0      setting  quotas  for  the  percentage  of  consumer  reports  that  must  contain 
de  r  ogat  ory  inf  orme.t  i  on ; 

0      requiring  investigative  personnel  to  complete  an  unreasonably  high  number 
of  investigative  consumer  reports  in  a  limited  time; 

k.    Retail  Credit  makes  it  difficult  for  consumers  to  review  the  contents  of 
their  records  by  refusing  to  make  them  available  at  regular  offices,  and  referring 
inquiries  to  "branch"  offices  which  are  usually  very  far  away  from  where  the 
consumer  is  located.     The  FTC  states  that  even  when  such  disclosures  are  made  to 
consumers,  re-investigations  are  not  made,  and  inaccuracies  are  not  corrected. 
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The  FTC  complaint  Is  still  being  heard  but  W.  Lee  Burge,  Chief  Executive  Officer  o 
Retail  Credit  (nov;  renamed  Equifax)  responded  publicly  to  the  PTC  charges  in  his  testi- 
mony at  the  Senate  hearings  to  consider  amendments  to  the  Fair  Credit  Reporting  Act.^^ 
Mr.  Burge  defended  the  investigative  techniques  of  his  company  and  specifically  denied 
that  it  sets  quotas  for  derogatory  information.     In  his  comments  on  the  proposed  amend- 
ments, he  stated  that  the  present  law  serves  consumer  needs  for  access  adequately,  and 
that  changes  would  Injure  the  consumer.     The  proposal  for  advance  notification  of  an 
employment  or  insurance  Investigation,  for  example,  would  delay,   for  both  the  customer- 
company  and  the  consumer,  decisions  on  employment  to  the  detriment  of  the  job  applicant 
and  might  result,  Mr.  Burge  said,  in  a  motorist  driving  an  uninsured  car. 

As  to  the  requirement  for  disclosure  of  sources  of  information,  Mr.  Burge 
responded  that  if  Retail  Credit  could  not  promise  confidentiality  to  its  sources, 
they  would  inevitably  dry  up.     He  gave  as  an  example  the  consumer  who  is  engaged  in 
underworld  activity  who,  if  told  the  source  of  an  unfavorable  comment,  might 
intimidate  or  physically  harm  the  informant.     Mr.  Burge  added  that  such  a  requirement 
of  disclosure  would  also  shut  off  sources  of  favorable  comments  as  well  as 
unfavorable  ones. 

Maintaining  Medical  Records  in  Health-Hazardous  Industries 

Medical  record-keeping  in  employment  can  be  of  vital  importance  not  only  from 

the  point  of  view  of  individuals  securing  .iobs.but  for  maintaining  good  health  on 
25 

the  job.      In  the  last  twenty  years,  scientists  have  been  uncovering  compelling 

evidence  that  exposure  on  the  job  to  certain  widely  used  industrial  products — 
asbestos  and  vinyl  chloride  among  them — causes  an  alarmingly  high  incidence  of 
cancer.     One  of  the  chief  problems  in  controlling  the  disease  is  that  it  usually  does 
not  surface  until  twenty  or  more  years  after  exposure.     That  makes  careful  medical 
record-keeping  essential.     Initially,  the  goal  of  the  managers  of  the  industries 
that  use  these  products  was  to  play  down  their  connection  with  cancer,  and  to  this 
end,  many  companies  kept  no  health  records  at  all.     Dr.  Irving  Selikoff ,  one  of  the 
leading  researchers  in  this  field,  tried  to  secure  medical  and  employment  records  of 
workers  in  an  asbestos  plant  after  1?  of  his  private  patients  died  of  cancer  after 
having  worked  there.     He  wanted  to  track  down  the  other  700  workers  so  that  they 
could  be  x-rayed  for  the  disease.     The  president  of  the  asbestos  company  told  him 
that  no  such  records  were  available . 

Increasing  pressure  from  the  medical  profession,  especially  from  articles  in 
scholarly  journals,  and  from  the  Occupational  Sai"ety  and  Health  Administration  of 
the  Labor  Department  and  the  AFL-CIO  Industrial  Union  Department,  forced  the 
asbestos  Industry  to  permit  x-raying  of  workers  in  many  plants.     But  the  workers 
were  not  told  why  they  were  being  x-rayed,  nor  were  they  told  what  the  safe  levels 
of  asbestos  dust  were,  nor  that  the  government  had  required  those  with  the  greatest 
exposure  to  wear  respirators.     Physicians  and  other  health  professionals  were  hired 
to  examine  workers,  but  their  findings  were  not  shared  with  the  individual  workers 
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examined,  nor    were  atmospheric  tests  shared  with  their  medical  colleagues. 

The  secrecy  of  medical  findings,  including  the  lack  of  access  to  the  workers 
to  whom  the  information  is  a  lif e-or-death  matter,  brought  a  stinging  rebuke  from 
Jacob  dayman,  secretary  of  the  AFL-CIO  Industrial  Union  Department,  in  a  speech 
on  the  relationship  of  vinyl  chloride  to  cancer: 

"Multi-corporate  studies  of  cancer  from  vinyl  chloride  were 
initiated  secretly  in  this  country  and  in  Europe...  Their  results 
would  probably  still  be  a  secret  without  the  presence  of  the  mass 
media  and  if  the  law  did  not  require  the  reporting  of  occupational 
disease    [the  Occupational  Health  and  Safety  Act]..." 

Most  often,  when  charges  are  made  that  medical  care  ajid  medical  record-keeping 
in  employment  are  serving  the  interests  of  employers,  ajid  not  of  the  employee/ 
patient,  the  complaint  is  about  lack  of  confidentiality  of  patient  records.  In 
the  industrial  chemical  field,  the  charge  is  the  same,  but  the  complaint  is  lack 
of  access. 

Licensing 

All  states  have  some  licensed  occupations  for  which  the  health  of  applicsmts 
is  deemed  relevant.        Where  employees  deal  with  the  public,  it  is  generally  required 
that  they  be  free  of  communicable  diseases.     Thus,  in  many  states,  barbers,  nurses, 
hospital  workers,  food  handlers  and  others  have  to  be  tested  for  such  things  as 
TB  and  VD.     In  some  states,  dental  hygienists  are  tested  for  these  diseases  when 
they  initially  apply  for  a  license. 

Psychological  criteria  also  play  a  role  in  licensing  decisions.    Taxi  drivers 

in  New  York  City  axe  checked  through  state  fingerprint  files  to  see  if  they  have 
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ever  been  a  patient  in  a  state  or  county  mental  institution.        Such  a  check  is 

possible  because  identifying  information  on  all  patients  admitted  to  government 

psychiatric  facilities  is  routinely  forwarded  to  state  law  enforcement  files. 

Identification  records  from  mental  hospitalization  files  in  Michigan  are  similarly 
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available.        In  a  recent  case,  a  court  decided  that  an  ex-mental  patient  could  not 

be  refused  a  hack  license  by  the  New  York  City  Police  Department  solely  on  the 
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ground  of  his  prior  "mental  illness."  ^    Even  so,  the  ex-patient  got  his  license 
only  by  agreeing  to  submit  to  a  psychiatric  examination  every  six  months. 

The  role  that  medical  information  can  play  in  driver  licensing  is  illustrated 

by  the  recent  controversy  surrounding  the  adoption  of  new  motor  vehicle  regulations 
30 

m  Maryland.^      The  original  draft  of  the  regulations  required  those  applying  for 
or  renewing  a  driver's  license  to  list  past  treatment  for  the  following  conditions: 
cerebral  palsy,  diabetes,  epilepsy,  multiple  sclerosis,  muscular  dystrophy,  heart 
condition,  stroke,  disabling  arthritis  or  rheumatism,  drug  or  narcotic  addiction, 
mental  or  emotional  condition,  mental  retardation,  multiple  sclerosis,  and 
alcoholism.     In  addition,  the  Motor  Vehicle  Administration  implemented  the 
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information  gathering  by  supplying  Maryland  doctors  with  reporting  forms  to  be  sent 
to  the  Motor  Vehicle  Medical  Advisory  Board  when  they  encountered  patients  with 
disorders  characterized  by  lapses  of  consciousness.     The  Medical  Advisory  Board  also 
received  complaints  filed  by  judges,  law  enforcement  officers  and  citizens,  the 
most  frequent  reports  coming  from  family  members  concerned  that  poor  eyesight  of 
elderly  people  and  alcoholism  made  their  relatives  unsafe  drivers. 

As  a  result  of  protests  from  psychiatrists  and  other  members  of  the  medical 
profession,  arthritis,  rheumatism,  mental  or  emotional  condition,  and  mental 
retardation  were  removed  from  the  list  of  reportable  conditions  in  the  regulations 
finally  adopted.     For  those  remaining  conditions,  the  license  applicant  must  secure 
a  physician's  certificate  describing  the  diagnosis  and  prognosis  of  the  disease, 
along  with  the  medication  prescribed.     If  the  license  is  refused  or  revoked  on  the 
basis  of  the  certificate,  the  applicant  is  entitled  to  a  hearing  before  the  Medical 
Advisory  Board  to  introduce  medical  evidence  to  support  the  granting  of  the  license. 
In  response  to  an  inquiry  from  the  Maryland  ACLU,  William  T.  Bricker,  Deputy 
Administrator  of  the  Maryland  Department  of  Transportation  stated  that  "while  all 
records  of  the  Motor  Vehicle  Administration  are  public  records ., .the  sole  exception 
are  Medical  Advisory  Board  records." 

Most  state  motor  vehicle  departments  report  license  suspensions  and  revocations 

to  the  National  Driver  Registration  Service  of  the  Department  of  Transportation. 

These  reports  include  instances  in  which  licenses  are  revoked  because  of  mental  and 
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physicial  disabilities.^ 

THE  JUDICIAL  PROCESS 

We  have  already  discussed  the  doctrine  of  privilege,  describing  its  relative 

standing  in  the  common  law,  and  the  statutory  exceptions  that  permit  physicians  to 

testify  on  many  matters  from  the  patient's  record.    All  state  privilege  statutes 

contain  exceptions  that  cover  criminal  proceedings  so  that  medical  testimony  and 
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medical  information  can  be  introduced.-'^      In  most  such  cases,  a  non-medical  issue 
is  at  stake;     to  connect  an  individual  with  a  crime,  for  instance,  the  prosecution 
may  introduce  the  defendant's  previous  history  of  narcotics  addiction.  Defense 
lawyers  may  enter  an  insanity  plea,  necessitating  psychiatric  testimony    or  the 
introduction  of  psychiatric  records.    Either  defense  or  prosecution  may  attempt  to 
impeach  a  witness  by  introducing  evidence  about  his  or  her  psychological  condition. 

In  civil  suits,  the  medical  condition  of  the  individual  is  often  the  principal 
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focus  of  the  proceedings.^^    When  someone  makes  his  own  physical  condition  an  issue 
in  a  law  suit  (e.g.  by  bringing  a  personal  injury  or  malpractice  action)  most 
courts  will  permit  examination  of  the  plaintiff's  physician.     Medical  records  may 
also  be  subpoenaed  in  such  suits.  / 
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In  civil  commitment  proceedings,  of  which  there  are  thoussmds  every  year,  some 
kind  of  examination  report  from  a  court-appointed  psychiatrist  may  supplement  a 
complaint  from  police  or  faimily  members.        In  their  examinations,  court  psychiatrists 
sometimes  draw  on  hospital  reports.     Sometimes  complaints  are  made  that  such 
commitment  proceedings  are  all  too  often  purely  pro  forma 5     it  is  alleged  that  some 
psychiatrists  do  not  in  fact  conduct  independent  examinations  of  the  patient,  but 
merely  "rubber  stamp"  the  complaint  from  the  police  or  the  family  or  other  laymen. 
This  creates  a  court  record  that  the  individual  committed  is  a  danger  to  himself  or 
herself  or  to  others,  which  becomes  a  part  of  the  medical  record.     Thus  the 
individual  is  permanently  marked  by  a  decision  which  appears  to  be  a  medical  one, 
but  which  may  in  fact  not  be . 

Medical  record  information  is  also  introduced  into  quasi- judicial  proceedings 
such  as  disability  hearings,  probation  hearings,  and  workmen's  compensation 
reviews.^    The  medical  files  assembled  for  permanent  disability  cases  are  often 
particularly  extensive,  with  reports  from  personal  physicians  supplemented  by 
those  from  government-appointed  physicians  and  military  records. 

What  are  the  substantive  issues  raised  by  the  increasingly  widespread  use  of 
medical  record  information  in  the  courts? 


(a)  The  doctor-patient  relationship.    Physicians,  and  especially  psycho- 
therapists, argue  that  the  therapeutic  process  depends  upon  trust  aind  that  this 
trust  is  undermined  by  fears  that  therapists  may  testify  about  patients  in  court. 
When  the  new  rules  of  evidence  were  proposed  for  federal  courts,  psychiatrists 
were  able  to  convince  its  framers  in  Congress  that  even  if  communications  between 
medical  doctors  and  their  patients  were  not  to  be  privileged,  it  would  still  be 
necessary  to  privilege  psychiatric  communications.-^ 

(b)  Irrelevant  and  extraneous  medical  records.     Psychiatrists  and  medical 

doctors  are  resentful  about  producing  confidential  medical  records  in  court  for 

what  seem  to  them  frivolous  reasons.    For  example,  in  some  divorce  proceedings,  a 
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pro  forma  complaint  of  "mental  cruelty"  is  lodged.-'^'     Attorneys  sometimes  use  this 
as  an  excuse  to  subpoena  medical  or  psychiatric  records  which  are  irrelevant  to 
the  real  issues  of  a  divorce  proceeding.     It  must  be  noted,  however,  that  mental 
cruelty  is  not  always  a  legal  fiction  invoked  to  satisfy  a  particular  state's 
divorce  laws.    Mental  cruelty  can  in  fact  be  inflicted  by  one  faunily  member  on 
einother  and  may  play  a  crucial  role  in  custody  cases. 

Patients  and  medical  professionals  also  complain  about  the  lack  of  specificity 

in  subpoenas  for  medical  records,  and  the  fact  that  entire  medical  records  are 

photocopied  for  the  court,  rather  than  those  portions  that  are  relevant.  The 

responsibility  for  such  irrelevant  materials  reaching  court,  some  commentators  say, 
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lies  as  much  with  physicians  emd  hospitals  as  with  lawyers.'^      They  note  that  health 
professionals  respond  too  readily  to  subpoenas.     Instead  of  requiring  each  to  be 
justified  in  court  and  challenging  those  which  are  not  specific  enough,  they  are 
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likely  to  turn  the  whole  record  over  without  protest  when  confronted  by  a  subpoena. 

(c)  Informed  Consent.     As  previously  noted  in  our  discussion  of  privilege, 

a  California  psychiatrist,  Dr.  Joseph  Lifschutz,  was  sentenced  for  contempt  of 
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court  after  his  refusal  to  testify  about  a  previous  patient.        Lifschutz  argued 
that  genuine  informed  consent  to  the  release  of  information  from  therapy  records 
was  not  possible  and  that  the  therapist  should  be  allowed  to  refuse  testimony  when 
he  or  she  felt  it  in  the  best  interests  of  the  patient.     A  more  recent  challenge 
to  that  ruling,  now  in  the  appeals  courts,  involves  a  psychiatrist  who  refused  to 
answer  some  of  the  questions  put  to  him  about  his  patient.        His  appeals  brief 
argues  that  informed  consent  is  not  possible  because  the  patient  "...has  no 
knowledge  of  what  Dr.  Caesar's  answers  to  questions  about  her  might  be.  Meiny 
patients  in  psychotherapy .may  tell  their  therapist  things  they  perceive 
unconsciously  which  are  in  fact  not  true... or  they  may  have  no  recollection  or  a 
very  erroneous  recollection  of  what  they  have  told  their  therapist." 

(d)  Physicians'  Privacy.     As  noted  earlier,  confidentiality  of  patient 
records  is  seldom  at  stake  in  malpractice  suits,  since  the  patient  is  eager  to  waive 
it.     What  is  at  stake  for  the  medical  community  is  the  physician's  claim  to  privacy. 
Of  special  concern  to  them  is  that  tissue-committee  reports  and  other  internal 
review  coTnmittees  which  evaluate  physicians'  performance  with  respect  to  whether 
the  appropriate  diagnosis  was  made,  etc.,  will  be  used  against  them  in  court 
proceedings.        Opponents  of  courtroom  availability  of  such  documents  argue  that  it 
would  undermine  the  voluntary  cooperation  of  physicians  with  essential  evaluation 
committees,  and  that  the  evaluations  themselves  are  subject  to  misinterpretation. 
Proponents  claim  that  the  patient  has  the  right  to  know  if  his  physician  has  been 
criticized  by  his  peers  for  incompetence  or  negligence. 

PUBLIC  HEALTH  REPORTING 

We  have  already  mentioned  how  public  health  reporting  requirements  affect 
medical  re cord-keeping, and  discussed  the  subject  in  the  context  of  its  being  an 
exception  to  the  confidentiality  doctrine.     Nothing  more  needs  to  be  added  about 
this  subject  here  except  to  emphasize  that  the  areas  where  public  reporting  is 
required  by  law  have  been  growing  steadily  during  the  past  decades  and  are  likely 
to  continue  to  increase. 

THE  MEDIA 

We  have  also  discussed  the  use  of  medical  record  information  by  the  media  in 
the  context  of  the  "public  right  to  know"  exception  to  confidentiality.  The 
American  Hospital  Association  has  published  guidelines  for  the  release  of  patient 
information  to  the  media  which  suggest  the  following  proceduiresj 

o    A  prohibition  on  the  inspection  of  hospital  records  by  media  representatives . 
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o    A  prohibition  on  interviews  or  photographs  of  the  patient  without  the  signed 
consent  of  the  patient  and  his  immediate  family.    Even  when  patient  or  family  consent 
is  given,  the  hospital  should  overrule  them  if  it  feels  the  patient's  condition  may 
be  jeopardized. 

o    No  release  of  information  to  the  media  by  Emergency  Room  personnel. 

0    Information  released  in  hospital  bulletins  should  be  limited  to  name,  address, 
occupation,  sex,  age,  and  marital  status;  and  a  one-word  description  of  the  patient's 
condition  as   "good,"  "fair,"  "serious,"  or  "critical".     The  nature  of  the  injury 
may  be  given  but  not  the  details  (e.g.  head  injury,  but  not  whether  the  skull  is 
fractured;  poisoning,  but  no  statement  as  to  the  circumstances  or  kind  or  about 
motives.)     The  guidelines  would  prohibit  Einy  mention  of  a  patient's  having  been 
intoxicated,  or  whether  there  was  a  suicide  or  attempted  suicide. 

o    Hospitals  should  refer  media  requests  for  information  in  accidents  and 
criminal  cases  to  the  police,  or  in  the  case  of  death,  to  the  coroner's  office,  but 
only  after  notification  of  the  immediate  family. 

The  AHA's  guidelines  on  prominent  patients  state: 

"A  person  whose  activity  is  a  matter  of  public  interest,  or  whose 
livelihood  or  success  depends  on  his  being  kept  in  the  public  eye, 
forfeits. . .to  an  undefinable  degree .. .rights  of  privacy  generally 
ascribed  to  a  less  prominent  person." 

While  the  guidelines  suggest  that  patient  permission  is  still  necessary  before 
the  hospital  can  release  information  about  prominent  people,  they  go  on  to  say  that 
"the  hospital  has  the  added  obligation  of  pointing  out  to  the  patient  that  his 
hospitalization  is  likely  to  become  known  and... public  acknowledgment  will  usually 
be  in  his  best  interests...  [to  assure]  that  accurate  information  [about]  his 
condition  will  come  from  an  authorized  source." 

Reporters  usually  are  not  given  access  to  hospital  records  and  they  usually  do 

not  depend  solely  on  hospital  bulletins  for  their  medical  information.     The  variety 

of  other  sources  from  which  reporters  get  their  information  is  a  commentary  on  the 

looseness  with  which  confidentiality  is  all  too  often  guarded.     Reporters  say  they 

get  medical  record  information  from  police  officers,  from  tipsters  on  hospital  staffs, 

from  military  records,  and  from  the  Veterans  Administration.        In  one  case,  the 

Veterauis  Administration  opened  the  medical  record  of  a  hold-up  suspect  to  the  press, 

with  the  result  that  his  treatment  for  psychiatric  troubles  and  venereal  disease 

Lih. 

was  publicized  in  the  New  York  Times. 

Another  factor  is  that  there  is  a  double  standaLrd  about  information  released 
to  the  media.     Criminal  suspects,  state  mental  patients,  prisoners,  and  welfare 
clients  have  all  made  complaints  about  the  release  of  their  medical  records.  ACLU 
Director  Aryeh  Neier  writes  of  a  recent  case  in  which  a  detailed  description  of  a 
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murder  suspect's  psychological  problems  was  provided  to  the  press  by  his  prison 

he 

psychiatrist.        It  is  not  surprising  that  people  m  custody,  where  the  health 
provider's  loyalty  is  engaged  by  the  institution  instead  of  the  patient,  should  be 
disfavored  when  it  comes  to  release  of  confidential  medical  information. 

LAW  ENFORCEMENT 

Patients'  medical  records  are  a  natural  resource  and  temptation  to  law 
enforcement  officers.     They  provide  a  logical  place, for  example,  to  start  looking 
for  missing  persons j  to  get  information  from  victims  of  a  crime;  to  identify  drug 
abusers  and  through  them  to  locate  drug  distributors;  to  track  down  illegal  aliens; 
or  to  identify  suspects  thought  to  have  psychiatric  problems. 

In  some  states,  the  law  specifically  provides  that  police  may  get  certain  kinds 
of  information  from  medical  files.     The  California  Business  eind  Professional  Code, 
for  instance,  requires  physicians  to  keep  a  record  of  the  disposition  of  dangerous 
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drugs  for  three  years,  and  to  keep  the  records  open  to  law  enforcement  officers. 

In  other  cases,  the  law  allows  access  to  medical  files  when  the  court  decides  that 

this  is  necessary.        In  many  states,  the  law  is  not  clear,  and  this  allows  law 

enforcement  officers  to  make  use  of  medical  files,  at  least  for  identification  and 

location  of  a  suspect,  with  relatively  little  resistance.     In  the  Los  Angeles 

Medical  Center,  as  described  in  the  Profile  section,  there  is  a  police  officer 

stationed  full  time  in  the  medical  records  room  of  the  hospital  for  the  sole  purpose 
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of  checking  medical  records  for  law  enforcement  purposes. 

A  recent  study  of  three  large  Philadelphia  hospitals  by  R.J.  Nathan  illustrates 
that  there  is  sometimes  a  large  gap  between  official  hospital  policy  and  everyday 
practice  when  it  comes  to  making  medical  records  available  to  law  enforcement 
officers.^^    For  example,  the  official  policy  at  Pennsylvania  Hospital,  as  stated 
by  its  Medical  Record  Librairiaji,  is; 

"Medical  records  are  the  property  of  the  Hospital.     The  information 
recorded  in  the  patient's  medical  records  is  of  a  highly  confidential 
nature.     Such  information  should  not  be  disclosed  to  anyone  without  the 
written  consent  of  the  patient.    Even  with  the  patient's  consent, 
information  of  a  personal  or  privileged  character  should  be  given  only 
after  careful  consideration  of  its  value  in  determining  the  issue  in 
question. " 

Included  in  that  policy  is  a  guideline  that  confidential  information  will  not  be 
released  to  the  Philadelphia  Police  Department.     But  in  practice,  each  hospital 
admitted  its  cooperation  with  the  District  Attorney's  office  "if  there  is  an 
investigation  going  on."    What  constitutes  an  "investigation"  is  apparently  the  mere 
act  of  phoning  the  Medical  Records  room  and  requesting  information.     The  police  are 
well  aware  of  this  procedure  and  hardly  ever  make  the  initial  request;  rather  the 
D.A. 's  office  will  make  the  call. 
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Several  years  ago,  following  a  disturbance  at  the  Board  of  Education,  some  of 
the  participants  in  the  demonstration — black  high  school  students — were  injured  by 
the  police  and  either  taken  to  Pennsylvania  Hospital  or  got  there  on  their  own. 
After  they  were  treated  and  released,  a  police  captain  called  and  asked  the  names 
and  nature  of  the  treatment.     The  Record  Administrator  refused  to  supply  the 
information,  admonishing  the  captain  that  "he  should  know  better."    Three  days  later, 
a  member  of  the  District  Attorney's  staff  called  ajid  the  information  was  readily 
provided  with  no  further  "inconvenience." 

Mr.  Nathan's  study  further  notes  that  although  the  Selective  Service  System  is 
specifically  excluded  from  access  to  patient  records  in  all  three  hospitals, 
discretionary  administrative  decision-making  "will  inevitably  divulge  confidential 
material  to  either  local  or  state    [Selective  Service]  systems  emd  to  federal  agents 
of  the  U.S.  Attorney's  office  conducting  [draft-evasion]  investigations." 

Hospitals  are  not  the  only  places  where  law  enforcement  officers  are  given 
access  to  medical  records.     Many  high  schools,  especially  inner  city  schools,  have 
one  or  more  police  officers  permanently  stationed  in  them  and  they  are  given  access 
to  student  files,  including  medical  records. Law  enforcement  officers  also  seek 
information  from  insurance  companies'  records — usually  location  information — although 
they  sometimes  ask  and  receive  information  about  the  nature  of  an  individual's 
health  problems. 

Drug  rehabilitation  clinics  sire  also  likely  targets  for  police  investigation, 
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as  the  case  of  People  vs.  Newman ,  already  described,  illustrates.-'^      The  FBI  recently 
circulated  a  leaflet  to  physicians  containing  detailed  medical  information  about 
members  of  the  Symbionese  Liberation  Army  with  the  statement*  "If  any  of  the  above 
individuals  consults  you  for  medical  treatment,  you  are  requested  to  notify  your 
local  FBI  office. "^^ 

In  1972,  the  FBI  placed  advertisements  in  two  AMA  journals  describing  a  woman 
wanted  for  conspiracy  who  had  a  particular  skin  condition  for  which  she  might  seek 
treatment.^      Physicians  were  asked  to  contact  the  Bureau  if  they  identified  her 
among  their  patients.     Protests  against  the  ads  not  only  challenged  this  specific 
instance  of  cooperation,  but  raised  the  question  of  what  might  happen  to  the  doctor- 
patient  relationship  in  the  medical  profession  if  it  were  believed  that  such 
cooperation  was  routine. 

Our  society  accepts  a  certain  amount  of  law  enforcement  access  to  confidential 
medical  records.     The  public  reporting  requirements  bear  this  out.     What  is  not 
clearly  defined  is  at  what  point  and  under  what  circumstances  this  access  becomes 
an  intolerable  intrusion  on  citizens'  rights.     If  the  decision  is  for  more  tightly 
controlled  records,  then  it  seems  clear  that  the  only  way  to  secure  it  is  by 
specific  legislation  such  as  the  Comprehensive  Drug  Abuse  Prevention  Act,  which  was 
invoked  in  the  methadone  clinic  case,  or  the  statute  drafted  in  New  York  to 
protect  psychiatric  records  in  the  Multi-State  Information  System  (MSIS). 
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MEDICAL  RESEARCH 


Americans  are  generally  sympathetic  to  serious  research  and  to  medical  research 
in  particular.     Between  1950  and  1970,  public  and  private  expenditures  for  medical 
research  increased  nearly  twenty-fold,  from  around  $100  million  to  nearly  two 
billion  dollars  a  year.  ^ 

A  great  deal  of  medical  research  requires  identified  records  on  research 
subjects,  either  because  the  medical  treatment  of  specific  individuals  is  being 
follov.'ed  in  a  clinical  setting,  or  because  samples  of  research  respondents  are 
drawn  from  lists  of  patients  or  clients,  or  because  specific  individuals  are  being 
followed  over  long  periods  of  time.-^^ 

The  story  of  one  medical  research  project  conducted  by  staff  members  of  a 
Chicago  hospital  between  1950  and  1952  illustrates  how  crucial  identified  patient 
records  can  be,-^"^    During  those  two  years,  840  women  were  given  a  female  hormone 
called  stilbestrol  as  part  of  a  clinical  experiment  to  discover  whether  the  hormone 
was  helpful  in  preventing  the  complications  of  pregnancy.     The  women  were  not  told 
that  they  were  part  of  an  experiment  and  none  were  aware  that  they  were  its 
subjects.     In  1971,  scientists  discovered  "a  highly  significant  association  between 
treatment  of  the  mothers  with  stilbestrol  eind  the  development  of  vaginal  cancer  in 
their  daughters."   Because  identified  patient  records  were  kept  on  this  experiment, 
the  hospital  was  able  to  track  down  the  patients  (although  they  would  not  release 
figures  about  how  many  they  could  not  trace)  so  that  their  daughters  could  have 
frequent  checkups  to  detect  any  early  cancer  symptoms. 

This  experiment  also  highlights  the  various  civil  liberties  issues  involved 
in  medical  research j     the  problem  of  informed  consent,  for  example, when  a  group 
of  terminally  ill  patients  were  injected  with  live  cancer  cells  without  informed 
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consent?        the  problem  of  truly  voluntary  consent,  which  is  raised  whenever  prison 
inmates  are  "encouraged"  to  "volunteer    to  participate  m  the  testing  of  new  drugs  5 
the  question  Of  the  propriety  of  withholding  treatment  from  patients  for  research 
purposes,  tragically  illustrated  by  an  experiment  in  which  a  group  of  men  was 
allowed  to  go  for  many  years  without  treatment  for  syphilis  so  that  researchers 
could  study  the  course  of  the  disease. 

Some  other  complaints  have  surfaced  over  extracting  data  from  records  for 
research  purposes  without  securing  advance,  informed  consent.     In  one  case,  a  law 
professor  received  permission  from  a  judge  to  examine  court  files  of  189  randomly 
selected  cases  concerning  mental  illness  commitments,  including  the  psychiatric 
reports  that  were  part  of  the  proceedings.^^    When  the  research  was  challenged  in 
court,  the  majority  held  that  (1)  those  who  had  submitted  information  to  the  court 
file  had  no  way  of  knowing  that  it  might  be  used  for  purposes  beyond  the  commitment 
proceedings?  and  (2)  that  notice  of  the  proposed  research  would  have  to  be  given 
to  all  parties  concerned  if  there  was  a  reasonable  possibility  that  the  patients, 
families,  or  physicians  involved  would  object  to  the  researcher's  access. 
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Concerns  about  uses  of  patient  files  outside  the  hospital  are  also  reflected 

in  the  guidelines  of  a  number  of  professional  associations  such  as  the  American 

Hospital  Association,  the  American  Medical  Association  and  the  American  Psychiatric 

Association,  as  well  as  in  the  rules  of  research  sponsors  such  as  the  National 
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Science  Foundation  and  the  National  Institutes  of  Health.        Generally,  however, 
the  number  of  publicized  cases  of  harm  from  the  release  of  medical  data  for 
research  is  so  small  that  few  challenges  are  mounted  to  such  disclosure.     In  some 
recent  model  legislation  to  protect  psychotherapeutic  communications,  lawyers  for 
the  Mental  Health  Law  Project  stated  that  as  long  as  hospital  administrators 
reviewed  the  intent  and  procedures  of  research  projects,  the  use  of  identified 
patient  records  in  such  projects  was  legitimate  .^-^  "A  requirement  that  researchers 
obtain  authorization  from  each  patient  would  unduly  burden  research  efforts,"  they 
said. 

However,  some  psychotherapists  believe  that  the  very  collection  of  data  from 
mentally-ill  patients  is  an  invasion  of  their  privacy  and  interferes  with  therapy. 
In  connection  with  a  nation-wide  study  of  the  demography  of  mental  patients,  Dr. 
Martin  D.  Capell  of  the  Detroit  Metropolitan  Center  for  Problems  in  Living,  stated 
that  truly  voluntary  consent  is  impossible  where  patients  are  seeking  free  mental 
assistance,  and  further,  that 

"Being  coerced  into  revealing  personal  aspects  of  oneself  is 
dehumanizing.     It  is  the  equivalent  of  being  forced  to  undress  in 
public. . .Human  beings  typically  have  strong  conflicting  feelings 
about  their  education,  employment,  level  of  earnings,  housing  and 
previous  experience  with  psychiatric  treatment  or  hospitalization, 
just  as  they  do  about  revealing  themselves  bodily. 

"The  assurance  that  the  data  will  be  hsuidled  anonymously  is 
empty.     In  the  first  place,  the  receptionist  who  hears  the  responses 
is  a  real  person.     In  the  second  place,  the  patient  is  being  asked 
to  trust  some  anonymous  authority  to  look  after  his  personal  interests. 
This  is  a  poor  introduction  to  help  which  is  intended  to  encourage  people 
to  defend  their  own  interests  by  being  given  majcimal  power  of  self- 
determination."  64 

The  staff  of  the  Metropolitan  Center  for  Problems  in  Living  agreed  with  this 
position  and  withdrew  from  participation  in  the  research  project. 

Although,  as  noted,  there  have  been  few  cages  of  unwarranted  release  of  medical 
research  data,  the  possibility  does  exist.     In  1970,  researchers  at  John  Hopkins 
Medical  Center  began  genetic  screening  of  incarcerated  delinquent  boys,  and  a 
matched  population  of  non-delinquents,  to  see  if  the  institutionalized  boys  had 
a  higher  XYY  chromosome  make-up.        (Most  males  are  born  with  two  chromosomes  in 
pair  21  which  controls  the  development  of  sex  characteristics.     Perhaps  four  out  of 
1,000  males  are  borne  with  an  "extra"  male  chromosome  attached  to  that  pair  (XYY). 
There  is  thought  to  be  a  relationship  between  the  extra  chromosome  and  delinquent 
agressive  behavior.)    When  word  of  the  research  project  became  public,  the  press 
carried  suggestions  from  various  sources  that  the  data  should  be  turned  over  to 
the  juvenile  courts,  threatening  the  confidentiality  of  the  resesirch  project. 
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Furthermore,  no  consent  had  been  obtained  from  the  parents  or  the  incarcerated 
children.     Under  public  pressure,  the  researchers  devised  some  consent  procedures 
and  agreed  to  keep  the  research  results  confidential. 

More  recently  in  Boston,  a  Science  for  the  People  group  challenged  some 
Harvard  University  researchers  who  aire  screening  newborn  children  for  XYY  make-up 
and  then  following  the  boys  as  they  develop  to  see  if  behavioral  or  other  problems 
develop. The  critics  focussed  on  the  possibility  that  children  might  be 
stigmatized  by  a  record  of  a  genetic  "condition"  which  is  in  fact  meaningless,  and 
that  their  relations  with  parents  might  be  disturbed  if  the  parents  begsin  to  see 
them  as  suffering  from  a  genetic  disorder. 

In  both  these  cases,  and  in  other  genetic  research  as  well,  the  issue  of  patient 
access  is  complicated.     Parents  or  the  research  subjects  may  want  access  to  the 
screening  results,  even  though  researchers  may  not  be  able  to  explain  what  the 
findings  mean.     Such  situations  require  careful  counselling  ajid  researchers  are 
not  always  in  a  position  to  provide  it.    Responding  to  criticism  of  their  work,  the 
Harvard  researchers  said  they  would  tell  parents  that  some  kind  of  genetic 
irregularity  had  been  found,  but  would  not  specify  it  as  XYY.    A  very  sensitive 
follow-up  project  had  been  established,  they  said.     The  Science  for  the  People  group 
replied  that  telling  the  parents  about  the  irregularity  was  simply  a  plot  to  get 
them  into  the  follow-up  program. 
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SCHOOL  HEALTH  RECORDS 

67 

The  tradition  of  keeping  comprehensive  files  on  students  goes  back  to  the  1920 's, 
but  two  relatively  modern  trends  influence  the  medical  content  of  such  records. 
The  first  of  these  is  that  elementary  and  secondary  schools  have  become  places  for 
the  provision  of  public  medical  care.     In  many  communities,  children  receive  brief 
physical  examinations,  hearing  and  eye  tests,  and  vaccinations  in  the  school.  In 
some  communities,  the  school  nurse  determines  which  children  are  undernourished  and 
should  be  included  in  the  free  school  lunch  or  breakfast  program.     The  nurse  then 

shares  her  findings  with  the  local  welfare  department  which  determines  whether  the 
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child  is  financially  eligible.        More  recently,  mass  screening  for  sickle  cell 
anemia  has  been  carried  out  in  some  schools.     The  medical  information  stemming  from 
some  of  these  health  care  activities  is  put  in  the  school  files. 

The  second  trend  is  the  increased  frequency  with  which  the  medical  model  is 

applied  to  deal  with  the  learning  and  behavior  difficulties  of  children  in  the 

schools.     In  many  schools,  a  concerted  effort  is  made  to  identify  medical  conditions 

such  as  dyslexia  because  of  its  impact  on  early  learning.     Similarly,  thousands  of 

children  are  defined  as  mentally  retarded  or  brain-damaged  each  year  and  segregated 

into  special  school  programs.     Most  recently,  some  school  systems  have  begun  to 

define  troublesome  children  as  "hyperkinetic"  or  as  suffering  from  Minimal  Brain 

Dysfunction,  aind  to  urge  parents  to  obtain  the  medical  care  necessary  to  control 

their  behavior,  or  in  some  instances,  to  put  pressure  on  parents  to  sign  consent 
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forms  which  permit  the  school  to  administer  drugs  to  correct  the  condition. 


Over  the  past  twenty  years,  the  employment  of  school  psychologists  and 

counsellors  has  markedly  increased.     Sociologist  David  A.  Goslin  reports  that  more 

than  half  the  schools  he  studied  in  I968  report  recent  increases  in  the  gathering 
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of  psychological  data  about  their  students. 

Schools  vary  as  to  whether  medical  information  is  placed  in  a  special  file  or 
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left  in  the  student's  central  record.        In  some  cases,  teachers  comment  on  a  pupil's 

medical  or  psychological  problem  in  the  anecdotal  records  that  are  stored  along 

with  the  central  record  of  grade  reports  and  other  teacher  evaluations.     In  other 

schools,  such  reports  are  stored  separately  and  destroyed  when  the  student  graduates. 

Goslin  reports  that  ^■0%  of  the  schools  he  studied  keep  health  information  on 
73 

permanent  file.^    The  fact  that  elementary  and  secondary  education  is  substantially 
under  local  control  means  that  storage,  access  and  retention  policies  for  student 
health  data  differ  considerably  across  the  country's  school  districts. 
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Several  important  students'  rights  issues  are  raised  by  the  collection  and  use 
of  school  medical  records*     1)  the  possible  inaccuracy  of  medical  information  placed 
in  the  student's  file;     2)     the  stigmatizing  or  prejudicial  effect  that  this 
information — whether  accurate  or  inaccurate — may  have  on  the  student;     and  3)  the 
possible  inability  of  the  school  system  to  prevent  health  information  from  being 
released  outside  the  school. 

A  maior  controversy  about  the  release  of  student  medical  records  outside  the 
schools  took  place  in  New  York  City  in  1972.        A  New  York  City  Health  Code 
regulation,  passed  in  1963»  required  the  city  school  system  to  submit  the  names  of 
drug-addicted  students  to  the  Health  Department.     The  school  system  resisted 
complying  with  the  regulation,  supplying  instead  only  the  number  of  identified 
heroin  users  in  the  school  system. 

The  New  York  State  Commission  on  Investigation  issued  a  report  in  August,  1972 
sharply  criticizing  the  New  York  school  system  for  its  "negativism"  and  complaining 
that  "it  continued  to  receive  these  alarming  reports  [about  student  drug  addiction] 
but  did  nothing  about  them" . 

The  Chancellor  of  the  New  York  school  system  countered  that  "Counsellors  and 
drug-education  specialists  who  work  in  the  schools  have  expressed  serious  doubts  to 
me  that  they  could  successfully  obtain  the  confidence  of  students,  and  counsel  them 
away  from  drugs  while  also  reporting  them  to  the  central  register."    Finally,  under 
pressure  from  the  State  Investigation  Commission  and  the  New  York  City  Corporation 
Counsel's  office,  the  school  system  capitulated.    Chancellor  Scribner  issued  a 
directive  to  all  schools  to  turn  in  the  names  of  student  drug  users  to  the  Central 
Register. 

As  to  the  possible  inaccuracy  of  medical  data,  it  should  be  noted  that  much 

of  it  is  contributed  by  non-medical  people  such  as  teachers,  counsellors  or 

administrators.     A  teacher  may  note  on  a  school  record  in  passing  that  she  thinks  a 

student  is  retarded  or  that  a  student  has  psychological  problems  that  lead  to 

under-achievement .     The  problem  here  is  that  such  an  ad  hoc  evaluation  may  be 

transformed  through  time  and  transmission  into  acceptance  as  a  professional  medical 

judgment.     This  issue  has  been  sharply  raised  during  the  last  six  or  seven  years  by 

the  definition  of  disruptive  children  as  "hyper-active"  and  suffering  from  minimal 

brain  dysfunction.     While  the  label  sounds  like  a  medical  one,  several  critics  point 
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out  that  it  is  a  syndrome  that  can  only  be  inferred  from  observation  of  behavior.'^ 
There  is  no  simple  medical  test  for  hyperactivity.    Writing  to  the  National  Committee 
for  Citizens  in  Education,  a  parent  told  of  her  8^  year  old  daughter  who  had  been 
diagnosed  as  mildly  hyperactive  in  kindergarten,  and  now  has  a  record  of  being 
"autistic"  and  "brain-damaged."    Several  professionals  in  this  field  have  seen  and 
tested  her  and  agreed  that  this  is  a  wrong  diagnosis.'''^ 
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Similar  issues  sire  raised  in  the  definition  of  school  children  as  "mentally 
retarded",  which  usually  results  in  their  being  placed  in  special,  often  inferior, 
classes.''''''    The  consequences  of  being  mistakenly  labeled  "retarded"  are  severe* 
teachers  alter  their  notions  of  what  the  child  is  capable  of;  special  classes  may 
provide  much  less  education  than  the  child  could  in  fact  handle;     the  child's 
relationship  with  peers  changes;  and  as  a  result  of  all  this,  the  child's  self-image 
can  be  damaged,  causing  very  real  psychological  problems  indeed. 

But  even  where  the  judgments  are  accurate,  its  significance  may  be  misunderstood 
by  teachers  and  others  who  see  the  record.     That  was  the  fear  expressed  by  parents 
about  the  widespread  sickle-cell  testing  done  on  black  children  in  schools.  A 
group  of  New  Jersey  parents  filed  a  complaint  with  the  State  Board  of  Education  which 
challenged  the  decision  of  the  Orange  School  Board  to  have  school  nurses  and  lab 
technicians  test  for  sickle-cell  in  the  city's  predominantly  black  schools: 
"...serious  economic  and  social  ramifications  are  resulting  from  the  improper 
stigmatization  of  the  sickle-cell  trait."    The  parents  and  other  commentators  felt 
that  such  testing  might  harm  already  disadvantaged  children  because  teachers  might 
not  fully  grasp  the  fact  that  this  trait  has  no  medical  consequences  for  the  child 
at  all. 

Such  fears  about  accuracy  amd  relevance  of  the  materials  in  students"  files  were 

a  chief  impetus  to  the  passage  of  amendments  to  the  Elementary  and  Secondary 

Education  Act.     Known  as  the  Fsimily  Educational  Rights  and  Privacy  Act,  the 

legislation  for  the  first  time  gives  parents  and  students  over  18  access  to 
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elementary  and  secondary  school  records.        The  Act  has  been  in  effect  for  less  than 
a  year,  and  it  is  too  early  to  tell  how  widely  parents  and  students  will  avail 
themselves  of  this  new  access  and  what  effect  it  will  have  on  how  school  records  are 
kept . 
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REHABILITATION  AND  SOCIAL  WELFARE  PROGRAMS 


Local,  state  and  federal  government  are  undertaking  an  increasing  number  of 
rehabilitative  and  social  welfare  programs  that  involve  medical  records.     Two  such 
programs — treatment  of  drug  addicts  and  child  abuse  registries — illustrate  the 
ongoing  controversy  about  how  many  records  should  be  kept  and  to  whom  they  should 
be  disclosed. 

Drug  Addict  Centers 

It  is  not  surprising  that  law  enforcement  agencies  are  keenly  interested  in 
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drug  addicts,  and  the  records  kept  on  them  at  drug  treatment  centers.        The  cost 
of  maintaining  a  heroin  habit  for  one  day  is  estimated  at  between  $40  to  $150.  This 
means  that  the  average  addict  (who  does  not  have  independent  means)  must  steal  up  to 
three  times  the  cost  of  his  habit,  since  he  can  usually  sell  what  he  steals  at  no 
more  than  a  third  of  its  value.     It  is  estimated  that  between  30%  to  50%  of  all  crime 
is  drug-related. 

On  the  other  hand,  medical  experts  stress  that  drug  addiction  is  a  disease 
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and  can  be  cured  only  through  mental  health  treatment.        The  most  common  technique 
is  to  provide  medical  and  moral  support  during  withdrawal,  and  then  to  administer 
a  heroin  substitute  such  as  methadone  in  stable  dosages  over  protracted  periods 
while  providing  medical  care,  psychiatric  treatment,  and  job  and  family  counselling. 
Part  of  the  treatment  is  the  establishment  of  a  confidential  relationship  between 
therapist  amd  addict. 

As  the  director  of  one  methadone  clinic  put  it:     "The  entire  effort  made  in 

treatment  and  rehabilitation  would  quickly  be  frustrated  if  "treatment"  appeared 

to  be  nothing  more  than  a  law  enforcement  technique  aimed  at  identifying  and 

harassing  those  who  seek  help. . .Without  the  confidence  and  trust  established  by 

82 

insuring  confidentiality,  those  who  need  help  most  will  not  ask  for  it." 

Mistrust  in  promises  of  confidentiality  was  the  main  reason  for  the  failure 
of  the  armed  forces'  massive  effort  to  deal  with  military  drug  abuse. The 
mistrust  was  well  founded.     To  encourage  participation  in  its  drug  treatment 
program,  the  Service  promised  that  drug  abusers  who  volunteered  for  it  would  not 
be  punished  for  possession  or  use,  or  given  less  than  honorable  discharges.  But 
according  to  testimony  at  Senate  hearings  in  1972,  many  servicemen  who  sought  help 
for  their  drug  problems  received  none.     Instead  they  were  processed  for  administra- 
tive discharges  as  drug  abusers. 

Government  agencies  supporting  methadone  maintenance  clinics  sometimes  wish 
to  examine  patient  records  for  other  than  law  enforcement  reasons.  The  Food  and 
Drug  Administration  charged,  for  example, that  a  clinic  in  New  York  was  failing  to 
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determine  whether  its  patients  were  heroin-addicted  when  they  applied  for  treatment. 
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The  clinic,  the  FDA  claimed,  was  thereby  creating  methadone  addicts  out  of  non-heroin 
users.     Clinics  in  California  were  charged  with  encouraging  patients  to  secure 
methadone  from  three  or  four  different  clinics  by  refusing  to  submit  the  names  of 
their  patients  to  a  central  register. ^-^ 

According  to  a  survey  of  172  Methadone  Maintenance  Clinics,  a  third  of  the 

states  have  laws  requiring  that  a  physician  file  a  report  whenever  he  treats  am 
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addicted  patient  and  nesirly  all  of  these  laws  require  the  patient's  identity. 
Four  states  specify  that  the  reports  must  be  held  in  confidence;  two  states  require 
them  to  be  confidential  except  to  health  and  law  enforcement  agencies;     in  two 
states  they  are  open  to  general  inspection;  and  in  the  rest  of  the  states, 
confidentiality  of  the  records  is  not  mentioned. 

Most  of  the  states  with  drug  reporting  laws  keep  centralized  state-wide 
drug-addict  registries  which,  in  addition  to  patient  identities,  contain  personal 
data  gathered  from  physicians  and  treatment  programs.     Local  and  state  agencies  that 
fund  drug-treatment  programs  may  collect  additional  information.     One  drug  abuse 
program  director  complained  to  the  Pennsylvania  Council  on  Drug  and  Alcohol  Abuse 
that  "This  program  has  consistently  protested  demamds  made  on  it  by  the  Allegheny 
County  Mental  Health  and  Mental  Retardation  Program  to  supply  them  with  confidential 
information  concerning  our  patients. . .It  was  necessary  for  this  program  to  refuse  to 
accept  funding  from  (the  County)  in  order  to  protect  the  confidentiality  of  our 
clients ..." 

A  heated  controversy  about  San  Francisco's  methadone  maintenance  program 
involved  all  of  the  local  state  and  federal  agencies  who  fund  drug  treatment 
programs. ^"^    The  local  agency,  with  the  support  of  the  Mayor,  made  its  medical 
records  available  to  the  state  agency  which  funded  the  program  on  a  matching  basis 
with  the  federal  government.     But  the  local  agency  removed  the  patients'  names 
from  the  records,  except  for  the  patients  referred  to  treatment    as  an  alternative 
to  prison. 

The  state  charged  that  removing  the  names  was  in  violation  of  federal  guidelines 
and  ordered  the  clinics  closed.     The  local  agency  appealed  directly  to  the  Federal 
Food  and  Drug  Administration  which  finally  agreed  to  accept  the  records  without  the 
names.     But  the  state  remained  adamant  that  the  patients'  names  must  be  supplied. 
As  matters  stand  now,  the  clinics  are  closed  for  refusal  to  comply,  and  state 
legislators  are  introducing  bills  to  amend  the  State's  Welfare  ajid  Institutions  Code 
to  end  the  requirement  that  methadone  clinics '  patients '  names  must  be  supplied  to 
the  state . 

A  similar  controversy  arose  in  Massachusetts,  in  connection  with  the  Federal 
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government's  Client-Oriented  Data  Acquisition  Process  (CODAP).        In  this  program, 
in  return  for  federal  funding,  local  drug  programs  must  provide  the  following 
information  on  participants;     birth  date,  sex,  race,  zip  code,  first  two  initials 
of  mother's  given  name,  first  two  initials  of  mother's  surname.     The  information 
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could  be  interfaced  with  several  lists,  among  them  the  Social  Security 
Administration's  files  or  a  state's  vital  statistics  bureau  to  produce  the  name  and 
address  of  any  participant  within  30  seconds.     Both  the  Governor  of  Massachusetts 
and  the  Mayor  of  Boston  refused  to  authorize  supplying  this  information  for  drug 
patients  in  the  Boston  are  and  declared  they  would  forego  the  federal  funding 
rather  than  comply.     Again,  the  federal  government  made  a  special  exception  and 
said  it  would  not  cut  off  funding  if  the  patient  records  were  not  identified. 

According  to  the  survey,  methadone  treatment  centers  in  states  with  central 
drug  registries  complained  of  problems  of  maintaining  confidentiality  50%  more 
often  than  centers  in  states  without  such  registers.     The  information  sought  by 
central  registries  included  drug,  criminal  and  medical  history,  social  and  demograph 
data,  prior  drug  treatment  and  employment  data.     Moreover,  the  centers  complained, 
"information  in  government. . .files  frequently  finds  its  way  into  the  hands  of 
police  or  of  private  credit  bureaus  or  other  businesses." 

As  to  the  physical  security  of  the  records  within  the  172  centers  surveyed, 
95%  of  the  centers  keep  them  under  lock  and  key  and  protected  by  a  sign-out 
procedure  for  authorized  personnel.     Only  a  third  of  the  centers  use  the  additional 
protection  of  assigning  numbers  to  files  instead  of  patients'  names. 

Child  Abuse  Registries 

Recently  cited  statistics  estimate  that  one  American  child  in  500  dies  of  child 
abuse.     T;-     states  have  been  responding  to  the  growing  incidence  of  child  abuse  for 
some  years.     Between  1963  axid  196? ,  every  state  in  the  Union  and  the  District  of 

Columbia  enacted  a  child-abuse  reporting  statute  which  required  physicians  and  other 
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health  professionals  to  report  suspected  child  abuse.        In  the  past  eight  years, 

thirty  states  have  established  central  child-abuse  registries  to  which  any  person 
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may  report  a  suspected  case  of  child  abuse . ^ 

One  of  the  chief  purposes  of  the  central  registry  is  to  attempt  to  identify 
parents  or  guardians  who  are  involved  in  multiple  episodes  of  suspected  child  abuse. 
Abusing  parents  often  seek  to  conceal  repeat  episodes  by  bringing  the  child  to  a 
different  clinic  or  health  center  for  treatment  each  time. 

The  federal  government  also  maintains  a  national  child  abuse  registry  in  Denver 
at  the  National  Center  for  the  Prevention  of  Child  Abuse  which  operates  under  the 
auspices  of  the  Office  of  Child  Development  of  HEW.     The  thirty  states  with  central 
registries  send  unidentified  records  to  the  National  Center  for  statistical  studies. 

Most  of  the  legislation  establishing  central  registries  does  not  deal  with  the 
questions  of  access  by  accused  parents  or  guardians,  or  the  confidentiality  of  the 
material  in  the  registers.     The  typical  statute  simply  mandates  the  creation  of  a 
registry  to  which  any  citizen  may  make  a  report,  and  there  is  no  barrier  to  these 
registries  being  shared  with  law  enforcement  agencies,  the  courts,  social  service 
agencies,  welfare  departments,  etc. 
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Seven  states  impose  varying  degrees  of  confidentiality  on  the  records,  and 

the  New  York  statute  does  permit  access  by  parents  or  guardians  after  allowing  the 
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Department  of  Social  Welfare  ninety  days  in  which  to  make  an  investigation. 
After  that,  the  parents  or  guardians  must  be  informed  of  what  has  been  said  about 
them,  but  they  are  not  told  the  name  of  their  accusers.     The  accused  are  entitled 
to  a  hearing  with  due  process  protections,  and  if  the  accusation  against  them 
cannot  be  documented,  they  have  the  right  to  have  the  entry  about  them  deleted  from 
the  registry.     This  is  the  only  state  statute  with  an  access  and  deletion  provision. 

According  to  Alan  Sussman,  Director  of  the  Juvenile  Justice  Standards  Project 

of  the  American  Bar  Association,   "child  abuse"  is  a  loosely  interpreted  term.  A 

further  concern  is  that  the  registries  serve  only  to  stigmatize  the  parents  or 

guardians,  often  by  totally  unsubstantiated  gossip;     the  state  has  little  capacity, 

once  it  gets  information  on  child  abuse  to  provide  care  for  the  abused  child  or 
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counselling  for  the  abusing  parents.^ 

CONCLUSIONS 

Secondary  uses  of  medical  data  raise  the  sharpest  clash  between  society's 
interest  in  protecting  medical  confidentiality  and  its  interest  in  a  wide  variety 
of  other  important  functions,  both  private  and  governmental.     In  each  area  we 
examined  in  this  chapter,  a  rational  case  could  be  made  for  every  exception  to 
the  normal  rules  of  medical  privacy  and  confidentiality.     Sometimes  we  saw  the 
decision  to  override  confidentiality  traditions  embodied  in  the  law,  through 
legislation,  administrative  ruling    or  court  decision.     These  legally  sanctioned 
exceptions  tend  to  legitimate  those  other  exceptions  which  have  developed  simply 
as  a  matter  of  organizational  practice. 

There  are,  however,  two  important  recent  social  forces  that  operate  to  call 
these  exceptions  to  confidentiality  into  question.     The  first  is  the  movement  for 
social  change  during  the  past  two  decades  which  has  created  outspoken  constituencies 
for  racial  and  sex  equality,  cultural  and  sexual  diversity,  political  dissent, 
consumer  rights,  and  the  rights  of  such  stigmatized  groups  as  ex-mental  patients, 
persons  in  psychotherapy,  women  seeking  abortions,  etc.     These  groups  view  the  use 
of  health  criteria  in  decisions  about  employment,  education,  credit,  government 
benef its ,etc .  as  a  device  to  reinforce  restrictive  social  judgments  about  non- 
conforming social  behavior.     The  debates  such  critics  initiate  over  "privacy"  are 
often  really  challenges  to  the  way  that  conventional  society  confers  its  rewards 
and  favors  among  the  population. 

The  second  social  phenomenon  is  the  deepening  distrust  of  government  that 
marks  our  era,  not  only  among  the  forces  for  social  change,  but  in  the  general 
population.     This  cynicism  and  distrust  of  the  government's  willingness  and  ability 
to  protect  confidentiality  may  sometimes  overshadow  the  public's  approval  of  many 
of  the  secondary  uses  of  medical  data  treated  in  this  chapter.     In  an  era  of 
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confidence  in  the  government's  good  word  and  fair  play,  these  secondary  uses  would 
rarely  stir  significaint  public  concerns.     Given  the  harsh  realities  of  the  late 
1970 's  however,  any  discussion  of  secondary  uses  of  personal  medical  data  must  begin 
with  a  recognition  of  this  public  distrust,  and  a  realization  that  it  underlies  the 
growing  discussion  of  whether  existing  laws  and  controls  over  medical  data  uses  are 
sufficiently  protective  of  citizen  rights. 
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CHAPTER  4,     TRENDS  IN  COMPUTERIZATION  OF  MEDICAL  DATA 


INTRODUCTION 

Part  One  documented  how  widely  medical  (and  pseudo-medical)   information  is  now 
distributed  throughout  the  organizational  settings  of  Americaji  society,  and  noted 
the  main  civil  liberties  issues  involving  medical  data  that  had  already  come  to  the 
fore  by  the  time  computerization  spread  to  the  health  care  field.     Having  laid  down 
these  pre-computer  baselines,  we  turn  now  to  the  automation  of  personal  medical 
data. 

Computerization  in  health  care  is  expanding  in  response  to  the  same  general 
stimuli  that  have  made  automation  attractive  in  other  sectors  of  American  society. 
These  include;  rising  demands  for  private  and  government  services  by  customers  and 
consumers;  demands  for  faster  data  transmission;  the  heavily  increased  paperwork 
necessary  to  satisfy  such  trajisactional  demands;  the  rising  costs  of  clerical  labor; 
and  increased  government  reporting  and  auditing  requirements  to  satisfy  social 
accountability. 

These  pressures,  plus  some  special  ones,  are  present  in  health  care.  A 

dramatic  example  of  the  escalating  demand  for  services  in  the  health  field  is  the 

increase  in  annual  hospital  admissions;  from  10  million  in  19^)-0  to  21  million  in 

1955  and  then  35  million  in  197^.     This  .rise  in  patient  demand  for  services  comes 

both  from  the  well-to-do  and  from  the  indigent  who  are  now  covered  by  various  new 

governmental  payment  programs.     In  addition,  there  is  a  broadened  scope  to  medical 

treatment,  born  of  advances  in  drug  therapy,  operative  procedures,  and  medical 

technology;  greatly  increased  paperwork  required  from  doctors  and  health  institutions 

for  repayment  purposes;  increased  reporting  requirements  for  fiscal  auditing, 

quality-care  assurance  and  public  health  purposes;  the  high  cost  of  physician  and 

paramedical  time  in  meeting  such  record-keeping  and  reporting  requirements;  and 

most  recently,  the  growing  impact  of  various  legal  duties,  ranging  from 

documentation  of  procedures  to  avoid  malpractice  liability  to  recent  judicial 

decisions  requiring  mental  health  institutions  to  prove  they  are  furnishing  adequate 

care  to  their  patients.    All  of  these  functions — plus  others — create  an  enormous, 

ever-increasing  data-handling  operation.     Studies  within  hospitals  estimate  that 

from  25%  to  kO%  of  hospital  activity  is  devoted  to  collecting,  recording, 

1 

communicating,  and  reporting  medical  information. 

In  tracing  how  computers  have  been  used  in  health  care,  it  is  helpful  to  recall 

some  overall  trends  in  organizational  computer  usage  during  the  past  fifteen  to 
2 

twenty  years.      The  basic  pattern  has  'been  for  automation  to  move  first  into  an 
organization's  financial  activities  (payroll,  accounts  receivable,  etc.)  where 
personnel  had  previous  experience  with  electric  accounting  machinery  aaid  where  the 
data  being  processed  was  of  a  highly  routine,  fixed  character.     Computer  system 
developers  moved  next  to  automate  large-volume,  frequently  used  files  containing 
data  on  clients,  customers  and  subjects  that  was  easily  abbreviated  and  "objective" 
in  nature.     The  goal  here  was  to  replace  expensive  clerical  labor  who  were  performing 
repetitive  tasks,  with  the  additional  hope  that  services  could  be  improved  at  the 
same  time. 
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Many  organizations  moved  in  the  I970's  beyond  computerization  of  routinized 
operations  and  into  automation  of  more  narrative,  specialized  files,  attracted  by 
the  prospect  that  more  sophisticated  computerization  would  improve  the  quality  of 
decisions  by  line  officials  or  by  managers  (a  prospect  strongly  encouraged  by 
vigorous  marketing  from  the  computer  industry) .     Recent  years  have  also  seen  efforts 
by  some  organizations  to  develop  more  integration  of  their  various  personal  data 
files,  through  multi-file  databanks  and  management  information  systems.     Here  the 
objective  is  to  provide  a  comprehensive  information  system  for  management,  and 
even  to  reorient  major  aspects  of  the  organization's  structure  and  procedures  around 
the  "total"  information  system. 

On  the  whole,  this  general  progression  in  computer  utilization  has  been  the 
pattern  in  the  health  care  field.     In  describing  that  pattern,  we  have  focused  on 
the  first  two  zones  of  our  three  zone  model — primary  health  care  and  the  activities 
of  service  payers  and  quality  care  assurance.     This  will  be  followed  by  six  detailed 
"case  histories"  of  Zone  1   and  Zone    2   organizations  that  are  actively  engaged  in 
computerizing  personal  data  files.    Automation  in  Zone   5      is  so  extensive  and  so 
variegated  that  it  would  take  a  separate  study  to  describe  computerization  in  law 
enforcement,  government  welfare  and  social  service  programs,  employment,  education, 
etc.    Although  it  is  not  necessary  to  describe  the  entire  range  of  computerization 
trends  in  Zone  3     t  we  will  treat  the  development  of  government  health  agency 
activities  in  planning  and  program  oversight,  since  this  rests  so  heavily  on  calls 
for  health  data  to  be  furnished  by  Zone  1  and  2  organizations.     The  way  in  which 
automation  of  other  Zone  3  organizations  creates  demands  for  health  data  from 
individuals  or  health  providers  will  be  treated  in  detail  in  Part  Four,  the  section 
devoted  to  analyzing  how  computerization  is  affecting  citizen      rights  in  health 
data. 

ZONE  ONEt     PRIMARY  HEALTH  CARE  PROVIDERS 

There  are  almost  as  many  schemes  for  classifying  primary  health  care  providers 
as  there  are  professional  organizations  doing  the  classifying.    For  our  purposes, 
it  is  useful  to  organize  a  survey  of  computer  applications  here  under  three  main 
headings : 

A.  Doctors'   offices,   small  clinics  and  small  health  centers,  generally 
with  ambulatory  or  out-patient  practices. 

B.  Hospitals  and  larger  clinics  and  health  centers,     both  in-patient 
and  out-patient  services. 

C.  Other  primary  health  services,  such  as  corporate  health  departments, 
prisons,  nursing  homes,  etc. 

A.  Doctors'  Offices  and  Small  Clinics/Centers 

An  estimated  80%  of  health  care  over  900  million  patient  visits  in  1973 — is 
delivered  in  the  practitioner's  office.       While  there  has  been  no  national  survey 
of  EDP  use  by  individual  or  group  practitioners,  Daniel  Harris  of  the  American 
Medical  Association's  Department  of  Computer  Systems  in  Medicine  estimates  that 
between  10%  and  15%  of  these  practitioners  are  now  using  some  form  of  EDP.^  This 
assumes  use  by  about  2%>  -  5%>  of  sole  practitioners  and  perhaps  20^-25^  of  physicians 
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in  larger  group  practices. 

Most  of  this  computer  use  in  offices  is  done  by  contracting  with  organizations 
offering  service  bureau  operations  to  doctors.     These  include  bureaus  sponsored  by 
local  or  state  medical  societies,  commercial  firms    specializing  in  medical  data 
processing,  general  data-processing  service  bureaus,  and  bemk  and  insurance  company 
computer  services.     Generally,  these  are  batch-processed  operations,  with  input 
forms  sent  from  the  doctor's  office  by  messenger  or  mails  to  the  bureau  for 
processing.  Only  a  few  firms  offer  doctors  on-line  medical  billing  and  administrative 
reporting  services,  where  the  input  is  made  to  the  service  bureau's  central  computer 
directly  from  a  terminal  in  the  physician's  office.-^    A  very  small  minority  of 
doctor's  offices  have  their  own  computers  and  a  complete  data  processing  system  on 
the  premises. 

By  far  the  most  common  computer  application  for  doctor's  offices  is  billing  and 

accounting,  with  office-administration  and  claims-reporting  features  increasingly 

"hung  onto"  these  systems.     A  study  by  the  American  Medical  Association  found  only  a 

minority  of  office  computer-users  pursuing  more  clinically  oriented  applications; 

the  most  common  of  these  are  computerized  patient  histories,  automated  multi-phasic 

health  testing,  computer-assisted  diagnosis,  medical  records,  scheduling,  ECG 

analysis,  and  laboratory  analysis.^    In  addition,  some  doctors — probably  in  the 

hundreds — have  developed  computer  applications  geared  to  their  practice  specialties 

or  individual  research  interests,  mostly  by  obtaining  computer  time  and  file 
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storage  from  a  university  hospital  system  or  a  service  bureau. 

One  leading-edge  effort  to  stimulate  computer  use  in  the  doctor's  office  was 
a  federally-funded  (HEW)  project  conducted  between  1971  and  I974  by  the  consulting 
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firm  of  Bolt,     Beranek,  and  Newsman,  at  a  cost  of  $1.1  million.       Called  CAPO 
(Computer  Aids  in  the  Physician's  Office),  this  venture  placed  terminals  in  a  group 
of  13  physicians'  offices,  linked  by  telephone  line  to  a  central  computer  operated 
by  Meditech, Inc ,  Bolt,  Beraneic  and  Newsman  provided  software  programs,  orientation, 
and  instructional  training  to  the  physicians  and  their  staffs. 

The  computer  applications  furnished  by  CAPO  included  automated  medical  history, 
both  for  general  screening  and  various  specialties;  diagnostic  consultation; 
paramedical  support;  patient  education  and  family  health  planning;  and  administrative 
services  (billing,  patient  scheduling,  etc.).     When  the  project  ended,  four  of  the 
13  participating  offices  indicated  they  would  continue  the  computer  services  at 
their  own  expense.     Inside  and  outside  evaluations  of  the  project  agreed  that  some 
practitioners  liked  the  system  (where  it  responded  to  problems  they  felt  to  be 
important)  but  others  did  not  find  the  system  particularly  helpful.     The  costs  of 
hardware  and  software  as  of  197^  were  such  that  only  physicians  seeking  innovation 
in  their  office  routines  would  be  likely  to  adopt  such  a  service,  but  expected 
reductions  in  cost  would  probably  make  such  systems  more  attractive  in  a  few  years. 

Citizen  Rights'  Aspects  of  EDP  in  Doctors'  Offices 

We  noted  three  trends  in  doctors'  office  computer  use  that  affect  citizen 
rights.     First,  the  main  purpose — and  effect--of  adopting  an  automated  health 
screening,  patient  history,  and  patient  profile  system  is  comprehensiveness. 
Doctors  we  talked  to  said  that  the  range  of  subjects  covered,  including  physical  and 
emotional  state,  family  history,  social  situation,  and  any  economic,  political  or 
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other  stress-producing  factors  relating  to  medical  problems  was  far  greater  thein 
they  typically  obtained  with  patients  previously.     In  addition,  where  a  doctor  in 
the  " jot-it-down-on-a-5-by-8-card"  era  would  have  recorded  only  the  most  pertinent 
information,  often  in  a  half -legible  notation  useful  for  the  doctor's  own  needs, 
automated  patient  records  now  produce  detailed  personal  histories  that  can  be  read 
by  all  the  personnel  in  the  office. 

Second,  the  presence  of  such  detailed  records  creates  a  major  evidentiary 
resource    for  insurance  companies,  workman's  compensation  investigators,  and  others 
involved  in  civil  litigation  involving  claims.     These  records  offer  a  patient- 
elicited  declaration  of  conditions  at  the  time  the  history  was  taken,  plus  the 
results  of  various  lab  tests,  examinations  and  further  interviewing  that  are  part 
of  the  record  in  a  multi-phasic,  continuous  history.     Thus,  automated  patient 
screenings  and  histories  are  increasing  the  scope  of  data  collection  in  doctors' 
offices,  the  centralization  of  data  from  different  reporting  sources,  and  the 
potential  set  of  claimants  who  ask  to  see  such  records. 

Finally,  where  outside  EDP  services  are  being  used,  an  important  factor  is  the 
spread  of  personal  medical  information  to  service  bureau  employees.     The  very  fact 
that  a  well-known  person  has  visited  a  particular  practitioner  (especially  one  who 
is  a  psychiatrist,  or  a  cancer  specialist)  can  be  highly  sensitive,  and  thus  the 
disclosure  that  Citizen  A  is  being  billed  by  Doctor  B  could  be  a  significamt 
violation  of  medical  confidentiality.     Beyond  this  is  the  fact  that  some  medical 
billing  services  do  put  substantive  information  on  their  statements,   if  this  is  the 
way  the  doctor  gives  it  to  them  or  if  the  staxidardized  "billing  package"  calls  for  it. 
Service  bureaus  are  well  aware  that  confidentiality  and  security  of  the  data 
entrusted  to  them  is  vital  to  their  business  success,  and  various  kinds  of  personnel 
and  security  protections  are  used  in  these  operations.     However,  some  of  the  most 
celebrated  breaches  of  security  for  confidential  business  data  have  taken  place  in 
service  bureaus  during  the  past  decade,  and  the  movement  of  personal  medical  data  to 
this  location  deafly  represents  a  new  risk  to  confidentiality. 

Future  Prospects  for  EDP  in  Doctors'  Offices 

Spokesmen  from  medicine  and  the  computer  industry  expect  the  use  of  computers  in 
doctor's  offices  and  small  clinics  to  move  slowly  but  steadily  upward  in  the  next 
five  years.     They  cite  the  increased  exposure  to  computers  that  physicians  receive 
as  they  treat  their  patients  in  hospitals;  courses  in  medical  schools  about 
administrative  and  clinical  uses  of  computers;  the  current  trend  toward  greater 
group  rather  than  solo  practice,  creating  more  practice  units  for  which  computers 
could  be  cost-effective;  and  the  funding  of  various  pro jects( such  as  CAPO)  by 
federal  health  agencies  to  develop  tested  applications  and  encourage  greater  EDP  use 
in  doctors'  offices.     Possibly  the  most  important  factor  is  the  rapid  price  decline 
that  is  taking  place  in  computing  services,  as  small-system  computers  and 
minicomputers  move  into  monthly  costs  for  business  data  processing  that  many 
physicians  are  finding  attractive.^ 

B.  Hospitals.  Clinics  and  Health  Centers 

The  most  recent  national  survey  of  computers  in  hospitals  was  conducted  in  late 
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197^  by  the  American  Hospital  Association.        Questions  on  computer  use  were  sent  to 
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the  Association's  7,108  member  hospitals.     Of  the  5.912  hospitals  (83.2%)  that 

responded,  3i36^  (56.9?^)  reported  they  were  purchasing  out-of -hospital  computer 

services,  while  1,^^1  {2k, k%)  reported    having  their  own  in-house  computer.     (In  1970, 

a  survey  by  the  Hospital  Financial  Management  Association  reported  that  kZ%  used 
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outside  EDP  services  and  1^,2%  had  in-house  computers.) 

The  size  of  the  hospital  is  the  chief  factor  affecting  in-house  computer  use. 
Only  3. Wo  of  the  hospitals  having  6-24  beds  have  their  own  computer,  compared  with 
55.3%  of  hospitals  with  400-^99  beds  and  43.2%  of  hospitals  with  over  500  beds.  Size 
does  not  determine  the  purchase  of  out-of -hospital  EDP:     40.2%  of  hospitals  with 
6-24  beds  buy  computer  services,  compared  with  48.2%  of  hospitals  with  500  beds  and 
over. 

Of  the  hospitals  that  buy  outside  EDP  services,  the  AHA  survey  found  the  most 
common  applications  to  be  business  and  financial  (37.1%)  and  professional  audit 
(17.2%).     Electrocardiogram  analysis  (11%)  was  the  next  most  frequent,  with  dietary, 
radio-therapy  planning,  "other  clinical,"  and  "other  non-clinical"  among  the 
remaining  activity. 

The  survey  asked  hospitals  with  one  or  more  in-house  computers  about  the  kinds 
of  applications  being  used  in  each  of  ten  major  departments — nursing,  laboratory, 
pharmacy,  radiology,  admitting,  dietary,  medical  records,  personnel  management, 
out-patient/emergency,  and  intensive  care/cardiac  care.     The  responses  showed  that 
the  single  most  frequent  computer  use  was  for  budgeting  and  statistical  reporting, 
and  that  such  use  was  spread  quite  evenly  through  these  departments  (ranging  from 
13.6%  to  17.5%).     All  other  applications  combined  in  each  department  ranged  from  a 
low  of  3.5%  to  a  high  of  9%. 

In  terms  of  equipment,  684  hospitals  (11.6%)  have  large  computers  (defined  as 
costing  more  than  $100,000).     1-,017  (17.2%)  have  mini-computers  (defined  as  costing 
from  $10,000  to  $100,000)  and  402  hospitals  (6.8%)  have  remote  terminals.  260 
hospitals  (4.4%)  report  they  have  both  mini  and  larger  computers.     Use  of  terminals 
increased  with  the  size  of  the  hospital,  from  2  hospitals  having  6-24  beds,  to 
148  hospitals  with  over  500  beds.     The  use  of  terminals  in  hospitals  has  increased 
dramatically  since  this  survey  was  conducted  in  1974.     One  estimate  is  that  between 
one  and  two  thousand  hospitals  now  have  remote  terminals. 

These  survey  results  reflect  the  general  pattern  of  computer  use  found  by  the 
National  Academy  of  Sciences'  study  to  mark  the  rapidly  changing  world  of  computer, 
communications  and  microform  technologies  during  the  past  three  decades.     In  each 
field  of  business,  government,  and  associational  activity,  there  are  a  few 
organizations  whose  managerial  style,  resources,  competitive  position,  and  technical 
competence  lead  them  to  become  leading-edge  users.     They  are  the  first  to  try  new 
hardware  and  peripheral  systems  as  they  come  out,  to  attempt  ambitious  software 
applications,  and  to  risk  organizational  change  and  "people  problems"  in  these 
efforts.     Some  leading-edge  users  are  highly  successful  (measured  in  terms  of 
fulfilled  expectations,  realistic  costs,  etc.).     Others — possibly  a  majority  of  the 
pioneers — are  satisfied  with  enhanced  prestige  as  willing  experimenters,  rather 
than  being  able  to  show  truly  cost-effective  operations.     (Computer  experts  have 
coined  the  phrase,   "The  early  Christians  get  the  hungriest  lions...") 
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A  second  type  of  computerizing  organization  is  the  mainstream  user.     These  tend 
to  be  more  cautious,  willing  to  wait  until  new  equipment  and  applications  are  tested 
and  proved  by  others,  or  else  to  make  relatively  guarded  initial  adoptions  ("We  do 
things  in  a  modular,  step-by-step  way  here j  the   'big  bang'  isn't  our  style.")  In 
any  field,  this  is  where  the  great  majority  of  computer  users  are  to  be  found. 

Finally,  most  fields  have  their  low-users ,  those  who  do  some  computerized  data 
processing  but  are  well  below  the  mainstream  average  in  their  area.     Sometimes  this 
is  a  matter  of  size,  resources,   or  the  particular  function  within  the  field  that  the 
particular  organization  performs.     But  it  may  also  be  a  general  management  resistance 
to  computers  on  ideological  grounds;  fears  of  reaction  by  clients,  customers  or 
subjects  toward  automation  of  particular  information  functions;   or  resistance  by 
influential  groups  of  professional,  middle -management  or  line  employees  toward  the 
introduction  of  computers  beyond  a  limited  payroll-personnel/check-writing  level. 

The  hospital  field  fits  this  pattern  closely.     During  the  past  decade,  a  small 

number  of  American  hospitals,  perhaps  25-30,  have  attempted  to  develop  applications 

leading  toward  the  goal  of  unified  or  "total"  computerized  hospital  information 
13 

systems,       (When  asked  by  the  AHA  survey  whether  they  have  a  "computerized  hospital 

information  system,"  275  hospitals  (4.7?J)  say  they  do,  and  395  hospitals  (6.75?^) 

say  they  "plan"  to  have  one.     No  one  using  the  term  "hospital  information  system"  in 

its  usual  meaning  of  integrated  files,  common  data  base,  and  comprehensive  software 

can  take  such  declarations  seriously.     As  Collen  and  other  authorities  have  stated, 
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there  are  no  such  systems  in  operation  today,  nor  is  their  appearance  imminent.) 

Possibly  a  hundred  other  hospitals  have  pursued  new  applications  in  particular 
areas  beyond  the  mainstream  financial  and  administrative  uses,  as  with  various 
clinical  and  ancillary  services,  multi-phasic  screening,   on-line  patient  histories, 
in-house  research,  medical  education,  medical  audit,  and  the  like.     As  successes  have 
been  achieved  in  some  of  these  areas,  the  systems  have  been  shared  or  marketed,  ajid 
have  entered  mainstream  status. 

Low  users  are  probably  a  larger  percentage  of  the  hospital  community  than  in 
many  other  fields.  The  majority  of  hospitals  today  are  medium  and  small  sized 
institutions  and  are  still  limited  either  to  financial  and  reporting  applications 
supplied  by  service  bureaus  or  small  computers  with  software  packages  supplied  by 
computer  manufacturers. 

Special  Features  of  Hospital  Computerization 

Some  aspects  of  hospital  automation  bear  directly  on  citizens'  rights  and 
deserve  special  attention. 

1 .  Patient-Record  Application 

Only  a  minority  of  hospitals  with  in-house  computers  or  which  use  outside  EDP 

services  have  automated  their  stored  patient  medical  records.     Some  of  these  users 

have  patient-history  and  multiphasic  screening  programs,  and  some  have  developed 

automated  records  based  on  the  problem-oriented  medical  record  developed  by  Dr. 
1  5 

Lawrence  Weed.        Most  of  these  are  for  ambulatory  rather  than  in-patient  uses. 

2 .  Hospital  Information  Systems 

As  noted  above,  there  are  currently  no  full-dress  hospital  information  systems 
(HIS),  although  a  small  group  of  American  hospitals  is  working  toward  developing  them. 
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Among  them  are:   Kaiser-Pennanente      and  El  Camino  Hospitals  in  California;  Massachusetts 

General  in  Boston;  the  Harvard  Community  Health  Plan;  and  the  Texas  Institute  for 

16 

Research  ajid  Rehabilitation  in  Houston.        In  psychiatric  institutions,  HIS-oriented 

hospitals  include  the  Institute  for  the  Living  in  Hartford,  Connecticut;  Walter  Reed 

Army  Medical  Center  in  Washington,  D.C.  and  other  institutions  using  the  Computer- 

Support-in-Military-Psychiatry  project;  the  Fort  Logan  Mental  Health  Center  in  Denver, 

Colorado;  the  Connecticut  Mental  Health  Center  in  New  Haven,  and  other  institutions 

using  the  Multi-State  Information  System  for  Psychiatric  Patients,  developed  at  the 

Research  Center  of  Rockland  State  Hospital  in  New  York;  and  hospitals  participating 
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in  Missouri's  Standard  System  of  Psychiatry  project. 

What  distinguishes  these  HIS  projects  is  their  commitment  to  creating  a  single 
and  unique  patient  identification  number  and  concentrating  in  one  central  record  the 
data  from  all  the  patient's  past  and  present  hospital  and  out-patient  service 
contacts,  including  (if  present)  psychiatric  data.     The  goals  of  such  unified 
record-keeping  are  both  medical  and  administrative :  to  maJce  possible  the  most 
complete  and  informed  diagnosis  of  health  problems  and  evaluation  of  treatment,  and 
to  generate  the  data  base  from  which  to  improve  in-house  administration,  claims 
reporting,  professional  review,  and  basic  medical  research.     The  very  richness  of 
the  patient  records  in  an  HIS  system  underscores  the  citizens'  rights  issue — 'how 
securely  will  the  data  be  kept  from  those  within  the  institution  who  have  no  need  to 
see  it  (e.g.  limiting  psychiatric  data  in  general  hospitals)  and  from  those  outside 
payers,  quality-care  reviewers,  and  secondary-data  users  who  may  demand  access  to 
HIS  patient  files. 

3 .     Government  Hospitals  ' 

In  its  197^  survey,  the  AHA  included  36I  federal  hospitals,   1,^38  state  and 

local  government  hospitals,  and     4>113  private  hospitals.     Compajring  trends  in 
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computer  use  showed:  n        n        j-  ^      t  u 

^  Uses  Computer  Has  In-House 

Type  of  Institution  Services  Computer 

Federal  hospitals  53.5f°  16.6% 

State  and  local  government  hospitals  51.2%  23.9% 

Non-Government,  not  for  profit  63.0%  31.1% 

Non-Government,  for-profit  60.5%  12.6% 

These  figures  show  that  computer  use  by  government  hospitals  falls  between 

the  higher-use  not-for-profit  private  institutions  and  the  lower-use  for-profit 

institutions.     However,  trends  in  government  hospital  computerization  require  special 

attention  because  of  the  sheer  size  of  government  health  programs.    At  the  federal 

level,  for  example,  the  Veterans'  Administration  hospitals  are  the  largest  medical 

organization  in  the  United  States,  with  171  hospitals,  200  clinics,  5t500  full  time 

physicians  and  21,000  nurses.     In  1975»  they  serviced  1.1  million  veterans,  with 
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15  million  out-patient  visits  and  almost  30  million  prescriptions.   ^     To  the  VA 

system,  one  must  add  the  hospitals  maintained  by  the  U.S.  military  for  service  people 

and  their  dependents,  the  U.S.  Indian  Health  Service,  hospitals  for  the  Merchant 

Marine, and  special  federal  health  institutions.    Along  with  the  hospitals  maintained 

by  municipal,  county  and  state  governments,  this  puts  a  very  large  part  of  the 
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nation's  hospital  beds  and  hospital  admissions  under  government  auspices. 
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The  analytic  literature  on  computerization  in  government  hospitals  shows  that 
automation  patterns  do  not  fit  into  any  neat  "government"  versus  "non-government" 
categories;  the  leading-edge,  mainstream,  sind  low-user  patterns  in  hospital 
computerization  are  distributed  about  as  evenly  in  government  hospitals  as  elsewheril 
However,  enactment  of  privacy  legislation  affecting  government  agency  files,  such 
as  the  Federal  Privacy  Act  of  19?^  and  similar  Acts  in  four  states  as  of  early  1976, 
means  that  government  hospitals  will  be  the  first  affected  by  such  new  legal  rules. 

4.  iviiscellaneous  Health  Programs 

Automation  has  also  moved  into  a  number  of  other  health  care  activities. 

Automated  Multiphasic  Health  Testing  Centers  are  now  found  throughout  the  country, 

independent  of  hospitals,  with  well-known  firms  such  as  the  Life  Extension  Institute 

and  the  American  Health  Foundation  offering  this  as  an  off-the-street  commercial 

service.     The  patient  record  that  is  generated  is  given  to  the  patient  or  his/her 

physician,  but  a  copy  is  kept  by  the  screening  center,  much  as  income  tax  preparation 
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firms  keep  copies  of  the  returns  they  prepare  for  clients. 

Another  recent  development  is  the  wallet-sized  medical  history  card  or  "medal" 

that  individuals  can  carry  or  wear  wherever  they  travel.     Some  of  these  feature 

machine-readable  patient  data  strips  while  others  have  microfiche  forms  that  can  be 

put  into  readers  in  a  health  care  institution.     Such  personal  medical  information 

includes  allergies,  drug  sensitivities,  cardiac  readings,  conditions  such  as 

epilepsy,  and  other  matters  that  would  affect  treatment  if  an  individual  is  seized 

with  a  health  emergency  away  from  home.     Several  million  individuals  now  use  these 
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portable  medical-record  devices. 

Still  another  computerized  area  is  that  of  local  blood  banks,  both  the 
community-run  non-profit  agencies  and  the  commercial  blood  banks.        Here,  the 
acquisition  of  patient  m.edical  histories,  the  testing  and  coding  of  blood 
characteristics,  managing  inventories,  and  the  creation  of  files  matching  patient 
identities  carefully  with  donor  history  and  blood  code  have  prompted  considerable 
use  of  automated  systems.     The  American  Red  Cross  has  initiated  a  national, 

computerized  Donor  Deferral  System,  with  patient  identities  included,  designed  to 

.    .   .  2  S 

minimize  the  dangers  of  transmitting  hepatitis  by  blood  and  blood  product  uses. 

CITIZEN     RIGHTS  ISSUES  IN  HOSPITAL  EDP 
1 .  General  Changes  in  the  Patient  Record 

As  in  doctor's  offices,  computer  use  in  hospitals  is  changing  the  nature  of 
the  patient's  file.     In  many  hospitals  in  the  pre-computer  era,  record-keeping 
was  hit-or-miss,  and  though  lots  of  paper  accumulated  in  the  record,  these  documents 
were  often  in  disarray,  without  any  indexing  or  current  summary.     Now,  while  the 
character  of  personal  information  that  is  being  collected  for  automated  patient 
records  is  not  different  from  what  was  recorded  before,  the  automated  personal 
data  are  being  more  systematically  collected,  more  fully  recorded  and  more 
centralized  in  permanent  files.     Patients  processed  through  automated  history-taking 
are  systematically  asked  to  disclose  the  full  range  of  physical,  social,  family, 
emotional  and  other  personal  data,  and  the  resulting  detailed  patient  profiles 
become  a  regular  feature  of  the  file,  updated  steadily  as  the  patient  remains  with 
that  care  provider. 
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From  a  health  care  standpoint,  this  is  one  of  the  most  desirable  features 
of  automation — patient  records  are  full,  up-to-date,  easily  understood  and  are  linked 
together  from  various  departments  and  previous  episodes.     From  a  civil  liberties 
standpoint,  however,  this  trend  means  that  all  the  medical  and  paramedical  personnel 
in  a  facility  who  have  access  to  the  computerized  files  now  have  more  detailed 
personal  data  and  more  comprehensive  social  histories  than  in  the  typical  manual 
system,  except  for  psychiatric  facilities. 

In  addition,  computerization  of  patient  data  is  facilitating  (and  is  sometimes 
directly  intended  to  facilitate)  the  sending  of  some  automated  patient  data  to 
organizations  outside  the  primary  care  sector — to  service  payers  and  those  charged 
with  quality  care  assurance,  and  to  the  Zone  3  users  such  as  public  health  agencies, 
welfare  and  rehabilitation  programs,  licensing  authorities,   judicial  authorities, 
employment-insurance  evaluators  and  so  forth.     Much  of  the  computer-based  information 
activity  in  these  zones  depends  on  automation  of  data  bases  in  the  hospital  for 
timely  ajid  complete  input.     The  further  automated  the  hospital  data  are,  the  easier, 
cheaper  and  more  rapidly  Zone  2  and  3  organizations  can  call  for  production  of  what 
they  want.    Automated  centralized  patient  records  not  only  meaji  greater  ease  of 
transmission  at  a  lower  cost,  but  also  the  availability  of  far  more  detail  in  the 
medical  record  than  has  been  the  case  in  the  past.     This  means  that  these  records 
will  require  not  just  the  observance  of  traditional  standajrds  of  care  as  to 
confidentiality  (uneven  as  those  have  been)  but  a  new  definition  of  legal  and  public- 
policy  boundary  lines  for  data-sharing,  and  the  creation  of  monitoring  and 
enforcement  machinery  to  police  the  boundaries. 

2 .  Privacy  Issues 

'.Ve  have  observed  that  when  individuals  seek  medical  help,  they  willingly  reveal 
the  most  intimate  aspects  of  themselves  to  the  health  professional;  collection  of 
such  data  is  clearly  relevant  to  treatment.     Revealing  financial  or  family  data  may 
be  less  acceptable,  but  even  here,  the  justifications  for  requiring  disclosure  are 
strong. 

However,  as  we  noted  in  Part  One,  there  are  issues  as  to  what  should  be  recorded 
and  for  how  long  it  should  be  preserved,  as  in  the  case  of  the  San  Francisco  women 
who  sought  to  have  hospitals  return  the  "psychiatric-need"  letters  written  by  their 
doctors  to  justify  abortions  before  the  1972  Supreme  Court  ruling.     We  did  not  learn 
from  the  ACLU  attorney  handling  this  case  whether  there  were  any  coded  notations  in 
computerized  files  about  the  letters,  or  whether  they  were  only  kept  in  the  manual 
files.     But  the  problem  of  what  is  to  be  recorded  in  computerized  records  is  likely 
to  be  an  increasing  problem,  as  illustrated  by  a  letter  from  a  pediatrician  who 
practices  in  a  large  metropolitan  hospital: 

The  computerized  records,  she  wrote,  v/ere  "incalculably  valuable  for  both 
information  retrieval,  scheduling  of  appointments,  etc.     But  it  poses  terrible 
problems  in  our  treatment  of  adolescents.     What  do  I  do  when  a  youngster  tells  me 
she  is  sexually  active?    I  need  to  retain  this  information  to  assure  the  problem  is 
dealt  with  in  some  manner.     What  about  drug  use  (illicit)?    What  about  negative 
attitudes  towards  parents  or  school?    A  missed  menstrual  period  sind  possibilities  for 
pregnancy?    I  need  to  record  these  matters,  but  am  deeply  distressed  about  their 
availability  to  anyone  on  the  computer  (and  we  have  had  some  bad  experiences  in  this 
line). 
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"I  have  been  considering  a  bipartite  record;  the  first  is  available  to  anyone 
needing-  health  information  and  is  not  compromisory  data  in  any  way;  the  second  is 
"confidential"  data  and  either  not  stored  in  the  computer  at  all  (but  kept  in  a 
separate  confidential  drawer)  or  if  stored  only  available  to  one  or  two  key  people. 
But  this  is  difficult  to  work  out." 

We  see  this  as  a  Zone    1      issue  because  if  the  stigmatizing  information  were  not 
preserved  in  the  files  of  the  primary  health  provider,  the  problems  of  ancillary 
and  secondary  uses  would  be  eliminated  or  greatly  lessened.     If  primary  health 
providers  insist  on  preserving  everything  for  legal,  research,  or  administrative 
purposes,  we  can  expect  considerable  conflict  over  the  increasingly  rich  and  detailed 
files  accumulating  in  hospitals,  health-care  plans,  employer  medical  records,  and 
school  and  university  medical  files,  especially  in  the  automated  "total  patient 
information  systems" 

Also  a  privacy  matter  is  the  issue  of  whether  a  given  automated  system  has 
informed  patients  that  their  medical  data  is  being  automated,  and  how  it  will  be 
used. 

3 .  Confidentiality  Issues 

When  they  reveal  intimate  personal  data  to  health  professionals,  patients 
expect  these  to  be  kept  "confidential,"  following  the  ethical  and  legal  norms 
commonly  understood  to  attach  to  the  doctor-patient  relationship.     We  have  already 
discussed  how  widely  identified  patient  data  are  now  disclosed  for  Zone  2  activities 
and  for  many  secondary  governmental  and  private  uses  noted  in  Zone  3»  including 
releases  of  information  to  the  press,  to  law  enforcement,  and  to  commercial 
reporting  agencies  that  raised  serious  confidentiality  issues,  generally  because 
there  were  no  clear  legal  controls  over  such  data-sharing. 

Because  detailed  medical  records  are  still  kept  in  manual  files  in  primary 
health  care,  this  is  where  improper  or  disputed  leakages  of  personal  health  data 
are  still  centered.     The  same  management  policies,  doctor's  ethics  or  hospital 
cooperation  with  outsiders  that  made  these  disclosures  possible  could  take  place 
from  automated  medical  files  in  the  future  as  these  come  to  be  repositories  of 
more  detailed  patient  files.     Thus,  the  citizens'  rights  issue  is  to  see  how 
securely  the  more  detailed  and  "richer"  automated  records  can  be  secured  against 
such  misuse. 

Patient  Access  to  Records  and  Medical  Information 
Traditionally,  as  we  have  already  discussed,  the  medical  profession  has 
maintained  that  the  doctor  should  decide  what  the  patient  should  know  about  his/her 
condition,  treatment,  or  prospects.    Records  in  health  care  facilities  have  been 
considered  by  law  to  be  the  property  of  the  institution,  and  patients  normally  have 
been  able  to  inspect  their  records  only  by  bringing  a  lawsuit  for  negligence  and 
getting  a  court  order  authorizing  access.     In  recent  years,  consumer  and  patients' 
rights  groups  have  championed  the  right  of  patients  to  see  their  records  if  they 
wish  and  to  have  them  explained  by  the  doctors  where  the  notations  are  not 
intelligible  to  laypersons.     These  same  access  disputes  arise  when  personal  medical 
data  are  placed  in  automated  files;  where  no  duplicate  manual  files  remain,  the 
right  of  a  patient  to  get  a  printout  of  his  or  her  record  will  be  the  basic  issue. 
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Future  Prospects  for  Hospital  Computerization 

Hospitals  have  not  used  computers  as  extensively  as  many  other  industries,  such 

as  banking  or  insurance,    A  survey  in  1970  reported  that  after  a  decade  of 

automation  in  hospitals,   "55?^  of  all  hospital  information  processing  applications  are 
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still  performed  by  hand,"      and  this  figure  has  not  been  substantially  reduced  today. 

The  relatively  low  use  of  computers  is  reflected  in  the  sales  figures.     One  study 

2  8 

reported  that  sales  of  hospital  computers  in  197^  were  only  $156  million,  even 

though  American  hospitals  spend  between  7  and  10  billion  annually  (between  2^-33% 
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of  their  annual  budgets)  to  acquire  and  communicate  information.  ^ 

Studies  of  hospital  automation  are  in  agreement  about  the  causes  for  low  EDP 

use  here.-^      The  major  factors  have  been:  resistance  by  medical  practitioners  and 

allied  health  professionals;  the  high  costs  and  disillusioning  failures  of  early, 

widely-heralded  hospital  EDP  projects;  uncertainties  of  funding  for  venturesome 

efforts,  and  an  absence  of  strong  federal  commitment  in  this  area;  and  a  lack  of 

clear  "systems  concepts"  around  which  to  organize  the  files  and  flows  of  information. 

The  last  problem  is  seen  as  stemming  as  much  from  conflicts  within  the  medical 

profession  and  among  medical  plamners  as  to  the  ways  to  reshape  health-care  delivery 

as  it  has  been  the  failure  of  systems  experts  to  develop  good  systems  models  of  the 

medical  milieu  as  it  really  operates. 

However,  recent  marketing  studies  have  been  highly  optimistic  about  the  future 

of  EDP  use  by  hospitals.     One  study  predicts  hospital  computer  sales  will  go  to 

$380  million  by  1979.        More  specifically,  the  marketing  forecasts  predicts  much 

wider  use  of  remote  terminals  to  capture  medical  data  where  it  is  generated;  a 

surge  in  the  use  of  small  in-house  computers  among  smaller  hospitals  (75-300  beds); 

wide  use  of  computerized  hospital  management  systems  supplied  by  various 

manufacturers  and  services  on  a  "turnkey"  basis  (installed  and  ready  to  use);  and  a 

growth  in  multi-hospital  associations  or  data-management  plans  that  will  make  use  of 

shared  data  processing  facilities. 

Mainy  academic  and  medical-professional  analysts  reach  similar  conclusions  about 

the  bright  future  of  computer  use  in  primary  care.     Dr.  Marion  J.  Ball,  director  of 

the  computer  systems  and  management  group  at  Temple  University's  Health  Sciences 
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Center  divides  hospital  computer  systems  today  into  two  levels.        Level  I  is 
focused  on  data  collection  and  message-switching  capabilities  (administrative  data 
processing)  and  does  not  "maintain  an  electronic  patient  medical  file."  Such 
systems  now  cost  approximately  $1  to  $2  per  patient-day.     Level  II  systems  "maintain 
a  complete  computerized  patient  medical  record  during  the  patient's  hospital  stay, 
and  are  programmed  to  handle  clinical  information  as  well  as  requisitions."  Such 
systems  now  range  from  $2.50  to  $9  per  patient-day,  depending  on  how  many  clinical 
applications  are  in  the  system.     Using  Dr.  Ball's  classification.  Dr.  Stanley  E. 
Jacobs,  former  director  of  the  division  of  computer  systems  of  the  American  Hospital 
Association,  predicts  the  following:   "By  I98O  I  anticipate  that  at  least  50%  of  all 
short  term  general  hospitals  over  200  beds  will  have  installed  at  least  a  Level  I 
hospital  information  system.     By  1985f  I  expect  a  majority  of  these  hospitals  will 
have  Level  II . . . "^^ 
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Not  all  the  experts  agree  that  hospitals  are  approaching  a  major  take-off  point 
in  computer  usage — at  least  not  in  the  near  future.     At  the  conference  held  to 
discuss  a  preliminary  draft  of  this  report,        several  experienced  observers  of 
computerization  in  primary  care  emphasized  that  hospital  computer  uses  so  far 
represent  a  stitching  together  of  bits  and  pieces  of  separate  applications.  What 
has  been  lacking  is  the  development  of  a  conceptual  model  of  information  priorities 
and  uses  in  the  hospital,  especially  a  model  that  could  be  generally  accepted  by 
doctors  and  other  health  professionals  and  by  the  patients,  not  just  by  health-care 
planners,  hospital  business  managers,  and  data  processing  technicians. 

Until  such  a  professionally-acceptable  and  patient-regarding  model  is  developed, 
through  a  basic  rethinking  of  orgajiizational  goals,  professional  rewards  and  roles, 
and  man-machine  relationships,  many  experts  feel  that  computer  use  in  hospitals  will 
remain  oriented  to  administrative  data  processing  and  limited  clinical  programs, 
rather  than  moving  toward  larger  information  systems  of  integrated  files  and 
patient-record  data  bases.     Those  taking  this  view  believe  that  even  the  infusion 
of  large  amounts  of  money  for  developing  hospital  information  systems — something 
that  has  not  been  present  in  the  1965-1975  decade — would  not  lead  to  significant 
breakthroughs  in  the  near  future.    Even  passage  of  national  health  insurance  would 
not  make  a  major  difference,  in  this  view,  since  such  a  system  would  almost 
certainly  operate  through  limited  data  reporting  systems,  and  would  not  compel 
hospitals  to  develop  comprehensive  information  systems. 

One  of  the  reasons  for  the  divergency  of  predictions  about  more  sophisticated 
use  of  computers  in  hospitals  in  the  future  is  the  lack  of  agreement  about  their 
value  and  cost-effectiveness  in  the  present.     Most  observers  agree  that  computers 
have  helped  hospitals  and  health  centers  meet  the  crush  of  paperwork  in  patient 
billing,  accounting,  claims  processing  and  administrative  reporting.     They  also 
agree  that  computer  applications  in  perhaps  a  dozen  areas  of  clinical  use  have 
improved  the  delivery  of  services  and  have  been  cost-effective.     Beyond  these  areas 
of  agreement,  however,  the  effects  of  more  ambitious  information  systems  are 
difficult  to  measure  with  anything  approaching  scientific  rigor,  or  even  marketplace 
criteria.     While  some  interesting  efforts  have  been  made  to  evaluate  the  effects 
and  costs  of  particular  hospital  information  system  projects,  a  recent  conference 
on  the  evaluation  of  health  information  systems  concluded  that  there  was  little 
agreement  today  on  the  terms  and  procedures  for  such  evaluations,  and  that  it  may  be 
too  early  in  the  evolution  of  such  projects  for  evaluation  to  be  more  than 
experimental  and  tentative  . -^^ 

Because  our  study  deals  with  the  impact  of  computer  use  on  citizen    rights,  and 
is  not  a  study  of  the  effectiveness  of  hospital  computerization  on  health  care,  we 
did  not  attempt  to  make  a  national  estimate  of  how  hospital  information  system 
projects  are  doing.     We  did  look  to  see  how  the  activities  of  a  sample  of  such 
leading-edge  systems  are  affecting  individual  rights,  and  this  appears  in  our 
profiles  in  Part  Three. 
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C.     Other  Primary  Health  Services 

As  we  noted  in  Part  One  direct  health  care  is  provided  in  a  considerable  number 
of  institutional  settings  today  other  than  doctors'  offices,  hospitals,  and  public 
health  centers.     Automation  has  spread  deeply  into  some  of  these  other  locations, 
which  include  college  student  health  services,  corporate  medical  programs,  nursing 
homes,  prisons,   school  nurse  and  emergency  offices,  and  similar  facilities.     We  will 
look  at  one  of  these  college  health  services,  to  show  how  automation  is  being  used  in 
such  facilities. 

There  are  about  2,500  colleges  and  universities  in  the  United  States,  with  some 
7  million  students  in  attendance.     The  institutions  usually  provide  health  services 
for  resident  students  ranging  from  in-patient  emergency  care  to  regular  medical, 
dental,   and  mental  health  services  with  full  time  staffs  of  doctors,  nurses,  and 
other  medical  personnel.     Typically,   colleges  obtain  a  medical  history  from  the 
entering  student;  maintain  a  regular  patient  medical  record  during  the  course  of  the 
student's  matriculation,  and  keep  special  files  for  drug  and  alcohol  abuse  data, 
birth  control  and  abortion  data,  suicide  episodes,  psychiatric  care,  and  similar 
matters . 

Some  colleges  and  universities  have  developed  their  own  computerized  patient 

record  and  administrative  systems,  and  are  much  like  mediim^-sized  community  health 

centers  in  their  patterns  of  computer  utilization.     A  few  leading-edge  systems,  such 
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as  the  Harvard  Community  Health  Plan,       serving  students,  faculty,  and  staff  members 

of  the  Harvard  community,  have  pioneered  in  advanced  applications.  Particularly 

interesting  from  our  standpoint  are  the  commercial  firms  that  market  automated 

medical  questionnaires  and  problem-oriented  records  for  these  purposes.     For  example, 

Medical  Datamation,  an  Ohio-based  company,  offers  DASH,  Database  Acquisition  for 
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Student  Health.         This  is  a  964-item  self -administered  questionnaire  that  covers 
personal  identification,   family,  and  insurance  items,  then  asks  about  demographics, 
allergies,   immunizations,  hospitalizations,   illnesses,  disability,  other  medical 
problems,  operations,   fractures,  medications,  habits  and  risk  factors,  eating, 
exercise,   smoking,   alcohol,  drugs,  trauma,  and  information  or  help  wanted  by  the 
student.     The  questionnaire  also  asks  for  data  on  each  of  the  main  bodily  systems  and 
presents  44  questions  about  the  student's  feelings, 

DASH  offers  a  medical  database  report,   a  problem  list,  a  problem-monitoring 
report,  and  statistical  summaries,  all  generated  from  the  automated  data.     The  basic 
report  package  costs  about  $10  per  student.     The  company  claims  that  the  DASH  process 
saves  colleges  considerable  time  over  traditional  history  taking,  eliminates  the  need 
for  "most  pre-enrollment  physical  examinations"  for  the  average  student,  and  allows 
better  concentration  from  the  outset  on  students  with  problems. 

The  questions  asked  about  "Habits  and  Risk  Factors"  and  "Feelings"  illustrate 
the  scope  of  inquiry: 
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HABITS  and  RISK  FACTORS 

Vour  habits  influence  your  ability  to  achieve  and 
maintain  good  health  and  long  life.  Most  of  the 
questions  on  this  page  reflect  factors  which  increase 
your  risk  of  developing  physical  or  emotional  problems. 
Please  answer  each  question  realistically.  You  are  not 
being  "graded",  and  this  is  not  a  test. 


EATING     Do  you  generally  or  frequently  — 

Yes  No 

500      Eat  irregularly,  skip  meals? 

501      Eat  an  excess  of  animal  fats,  dairy  foods?* 

502      Eat  an  excess  of  sugar,  pastries,  starches?* 

503      Drink  5  or  more  cups  of  coffee  per  day? 

504      Drink  5  or  more  cola  drinks  per  day? 

505      Tend  to  stay  overweight? 

506      Tend  to  stay  underweight? 

507  —  —  Eat  fruits  regularly,  every  day? 

508      Eat  vegetables  regularly,  every  day? 

An  excess  is  a  LOT,  like  5  or  more  single  servings 
per  day  of  the  type  of  food  in  question. 


EXERCISE     Do  you  generally  or  frequently  — 
Yes  No 

  Get  heavy  exercise  on  an 

irregular  basis? 

 Consider  golf,  bowling,  archery  and 

similar  sports  strenuous  exercise? 

  Get  some  type  of  regular  exercise? 

  Get  regular  strenuous  exercise  such  as 

running,  swimming,  bicycling? 

  Do  you  know  the  type  of  exercise 

required  to  strengthen  the  heart? 


515 


516 


517 
518 


519   


SMOKING 
Yes  No 

525      Do  you  smoke  a  pipe? 

526   Do  you  smoke  cigars? 

527   Do  you  currently  smoke  cigarettes? 

528  —    —  Did  you  formerly  smoke  cigarettes  but 

stopped  completely? 

If  you  have  ever  smoked  cigarettes, 
specify  amount  and  duration. 


529   Less  than  y2  pack/day  533  . 

530   to  1  pack/day  534 

531   1  to  2  packs/day  535  . 

532   Over  2  packs/day  536 


_Less  than  1  year 
-1  to  5  years 
_5  to  10  years 
.Over  10  years 


ALCOHOL 

Yes  No 

540  _    Do  you  drink  alcohol? 

541  _   Did  you  formerly  drink  alcohol  but  stopped? 

If  you  have  ever  drunk  alcohol,  specify 
amount  and  duration. 

542  _Occasionally,  socially        546   Less  than  1  year 

543   Several  drinks/week  547          1  to  5  years 

544   Several  drinks/day  548  —  5  to  10  years 

545   More  than  3  drinks/day    549   Over  10  years 


DRUGS  Do  you  generally  or  frequently  — 
Yes  No 

555     Currently  use  pot,  speed,  downers, 

acid,  heroin  or  any  similar  drug? 

—  Formerly  used  such  drugs  but  stopped? 

—  Know  the  common  names  and  appearance 
of  various  forms  of  such  "street"  drugs? 

—  Know  the  short  and  long  term  effects 
of  these  drugs? 

If  you  have  ever  used  any  of  the  drugs  mentioned  above, 
specify  which  ones  and  how  often. 
Yes  No 


556- 
557  . 


558- 


559   

  Marijuana  (pot) 

560 

  Rarely 

561 

  Frequently 

562   

  Amphetamines  (speed,  uppers) 

563 

  Rarely 

564 

  Frequently 

565  — 

  Hallucinogens  (LSD,  acid,  mescaline) 

566 

  Rarely 

567 

  Frequently 

568  — 

  Narcotics   (heroin,  H,  morphine) 

569 

  Rarely 

570 

  Frequently 

571   

  Methaqualone  (Sophers,  Quaalude) 

572 

  Rarely 

573 

  Frequently, 

You're  well  over  half  done  now. 
The  hardest  part  is  over.    Press  on! 


TRAUMA,  ACCIDENTS  and  OTHER  HAZARDS 
Do  you  frequently  — 
Yes  No 

580      Ride  a  bicycle  on  heavily  traveled  roads? 

581      Ride  a  motorbike  or  motorcycle? 

582      Ride  a  motorcycle  without  helmet  and  jacket? 

583      Tend  to  exceed  the  speed  limit  while  driving? 

584      Drive  after  drinking  alcohol  or  taking  drugs? 

585     Water  ski  or  boat  without  a  life  preserver? 

586     Walk  alone  at  night  in  a  strange  neighborhood? 

587      Hitchhike  or  pick-up  hitchhikers? 

588      Get  exposed  to  very  loud  noises? 

589     Get  exposed  to  insecticides  or  dangerous 

chemicals? 

590           .  .  Know  how  to  swim? 

591      Wear  reflective  clothing  when  walking 

after  dark? 

592      Know  how  to  give  CPR  (cardio-pulmonary 

resuscitation,  artificial  respiration)? 

593      Know  how  to  give  mouth-to-mouth  breathing? 

594   Know  how  to  give  closed  chest  cardiac  massage? 
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FEELINGS  Mark  the  frequency  with  which 
you  have  the  feelings  or  problems  listed. 

M  =  Most  of  time 
S  =  Some  of  time 
N  =  None  or  rarely 


MSN 


850 
851 
852 
853 
854 
855 
856 
857 
858 
859 
860 
861 
862 
863 
864 
865 
866 
867 
868 
869 
870 
871 
872 

873 
874 
875 
876 

877 
878 

879 
880 
881 
882 

883 
884 

885 
886 

887 
888 
889 

890 
891 
892 
893 
894 
895 
896 
897 
898 

899 


Feel  sad,  depressed? 
Feel  lonely? 

Cry  without  apparent  reason? 

Wish  to  end  it  all? 

Plan  a  way  to  kill  self? 

Unable  to  concentrate  on  anything? 

Awaken,  can't  go  back  to  sleep? 

Still  tired  after  a  night's  sleep? 

Feel  tense  and  anxious? 

More  nervous  than  your  friends? 

Worry  about  health? 

Worry  about  things  generally? 

Have  trouble  falling  asleep? 

Jump  at  sudden  noises,  shake  badly? 

Have  frightening,  recurring  thoughts? 

Feel  calm  and  contented? 

Unusually  afraid  of  high  places? 

Unusually  afraid  of  closed  places? 

Unusually  afraid  of  crowds? 

Suffer  from  nervous  exhaustion? 

Get  upset  easily,  highly  irritable? 

More  touchy  than  your  friends? 

Go  to  pieces  if  you  don't  constantly 

exert  control  over  yourself? 

Get  angry  when  told  what  to  do? 

Feel  more  violent  than  your  friends? 

Get  along  with  people? 

Get  upset  when  things  are  not  precise 

and  orderly? 

Do  most  things  on  impulse? 

Feel  it  is  OK  to  steal  as  long  as 

no  one  gets  hurt  or  caught? 

Feel  overly  shy,  sensitive? 

Get  feelings  hurt  easily? 

Greatly  upset  by  criticism? 

Tremble  or  feel  weak  whenever 

someone  shouts  at  you? 

Feel  optimistic  about  the  future? 

Get  completely  mixed  up  when  you 

have  to  do  things  quickly? 

Afraid  to  be  alone? 

Usually  wish  you  had  someone 

to  advise  you? 

Have  feelings  of  inadequacy? 

Have  strong  feelings  of  dependency? 

Seem  to  be  more  aggressive 

than  your  friends? 

Have  legal  problems? 

Have  financial  problems? 

Have  marital  problems? 

Have  family  problems? 

Have  sexual  problems? 

Have  questions  about  sexual  matters? 

Feel  someone  is  out  to  "get"  you? 

Hear  voices  when  no  one  is  around? 

Feel  someone  is  controlling  you 

in  an  unusual  way? 

Feel  you  are  responsible  for  the  sins' 

of  the  world? 


TESTS  During  the  past  year,  have  you  had 

Yes  No 

920    Blood  count? 

921      Blood  sugar  check? 

922    Chest  x  ray? 

923    TB  skin  test? 

924  —  —  Urine  check  (urinalysis)? 


INFORMATION    Do  you  want  further  information 

on  the  following,  or  help  with  problems  you  may 

encounter 

in 

the  areas  described? 

Yes 

No 

930 

Alcoholism 

931 

Birth  control 

932 

Cigarette  smoking 

933 

Diet  programs 

934 

Drug  abuse 

935 

Emotional  problems 

936 

Exercise  programs 

937 

General  health  hazards 

938 

How  to  cope  with  loneliness 

939 

Legal  problems 

940 

Marital  problems 

941 

Money  or  financial  problems 

942 

Self-breast  exam 

943 

Sexual  problems 

944 

Venereal  disease 

945 

What  to  do  if  a  medical  emergency  occurs 

CONCLUSION 
Yes  No 

960      Do  you  have  any  other  problems  not 

covered  by  this  questionnaire? 

Please  give  us  your  opinion  of  this  system. 

961    Great 

962    Good 

963         Generally  good,  criticism  minor 

964          Don't  like  it 

Please  sign  your  name. 

Signature   

You're  done! 

Thank  you  for  completing  the  questionnaire. 

Please  check  back  through  to  make  sure  you  haven't 

skipped  any  sections  or  pages. 

Enclose  the  completed  questionnaire  along  with 
your  check  to  Medical  Datamation  in  the  postpaid 
envelope  and  mail  as  soon  as  possible. 
Good  luck  at  college! 


(a  Medical  Datamation  1975 
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From  these  questions,  DASH  produces  a  Medical  Database  Report  illustrated  by  the 
following  sample  on  a  fictitious  "Suzanne  M.  Taylor." 


DASH   MEOICfiL   HATABASE  REPORT 


MOUNTAIN  STATE  UNIVERSITY 


TAVL^R,   SUZANNE  M. 


Date  CoTiDletedl  1-16-76 
Questionnaire  Nymberj  65^>32l 
Entepj  9-76 
Class!   Not  9Dec  i  f 1 ed 


Age  19  Female 
DOB|  6-17-57 


SS;    1  23-ii5-67B<? 
HT!  a" 
WT!    122  lbs. 


Emepqencv  Not  1  * i c a 1 1  on j 
TAYLOR,    THOMAS  J. 
FATHER 

5596  CASTALIA  ST 
ROCKY  RIVER,    IL  32109 
Phones   Response  uncertain 


Hce  Acldr#»ss! 


25*^1   HILLCRFST  AVE 

wpnpi  AND,  MI 

Phono:  210-9fJ7-65ii3 


Hei»lth  Insurance! 

Plan  College  Insurance 


Famll V  Physl c 1  an! 
SCHMIDT,    EDWARD  A 
3<J99   ^  CENTRAL  BLVD 
WOODLAND,   MI  54321 


OEMOrRAPhlCi  8ern  USA,   USA  citizen,  Caucasian,   single*  children  (00), 
su^onrtea  by  fsmllyj  grew  uo  In  rural   area,   middle  Income  level, 
Prnt^stant,   object   to  blood  transfusion. 


PAST  HISTORY 


ALI  EOGIES!   Penlcl  1  Hn. 


IMMUMI2ATICN6!   DPT    "61,   polio  oral    '64,   smallpox    '62,    tetanus  toxoid  '71, 
No  Ger-nan  measles,   measles,  mumps. 


HO^PTTALIZATIONSJ    lUness   (01),   operation  (01). 


ILLNFSSES!    Allergies,   hay  fever. 

No  alcoholism,   anemia,   cancer,  depression,   diabetes,  emphysema, 
epilepsy,   heart   attaci**   heart  disease,   hypertension,   Insanity,  kidney 
disease,   nervous  breai<oowr,   oeptic  ulcer,   thyroid  disease. 


FA"I[  Y  III ''"lESSES!   Alcoholism,   allergies,   anemia,   depression,  diabetes,  hay 
fever,   heart   attack,   hyoertensl on,   migraine,   multiple  sclerosis  not 
specified,   nervous  breakc(oi*n,   rheumatoid  arthritis,  stroke. 

No  bieeoina  trait,   cancer,  ecilepsv,   heart  disease,   Insanity,  suicide 
attempt,   thyroid  disease,  tuberculosis. 


OTHEP  PBS:  Cystitis,  chicken  pox,  knee  Injury,  measles,  mumps,  ovarian 
Cyst,   whooDlna  cough. 

No  arthritis,  chronic  bronchitis,  spastle  colitis,  cholecystitis, 
German  measles,  gonorrhea,  hepatitis,  Infectious  mono»  pyelonephritis, 
phlehitis,   oolio,    rheumatic   fever,    rheumatic   heart,  svphills. 
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225-346  O  -  76  -  9 


(CHNTIMUEn  'JUESTIONNAIRF  bSUlil) 
0PFP«T10nS!    TonsU  1  ectomy. 


Page  2 


FP'CTUPES!  ^ope. 

ME<^ir  AT  lONSt  Antihistamine,  birth  control  med,  witamins*  other  ined  <  c  <  ne  ( 8 ) 
no''    H  St  eH, 

disability:   Permanent  Dhysical   disability,   ob  that  orecludes  taking  PE, 


HABITS    AND   RIS'<S  PACTORS 

DIFTary;  Eats  irregularly,   excess  saturatea  ^ats,   excess  co^^ee. 
No  excessive  carbohydrates,   cola  drinks, 

ExF"PriSE;   Irregular  heavy  exercise,   no  regular  strenuous  exercise,  lacks 
exerrlse   i  n  <opn^at  i  on, 

SMOKING;   Smoi«es  cigarettes,   less  than  1/2  pack  per  day,   less  than  1  year. 
Does  not   s'^oke  a  olpe,  cigars, 

ALTOHOU  Drinks  alcohol,   socially,   duration  not   specified  or  uncertain, 

DRl'G?J   Cannot    identify  street   arugs,    lacks  dru9  effect  Information, 
Does  not   currently  use  drugs, 

Tfi^U^'A/HAZAPOSs  Deficient  in  CPR,  deficient  In  resuscitation,  deficient  In 
Cardiac  ifassatae. 

Does  not   irive  after  alcohol   or  drug  use,  participate  In  hitchhiking, 
get  exposed  to  loud  nolsesi   get  exposed  to  dangerous  chemicals. 


SY«!TeMS  kFVIEW 

HE*0!   No  problem. 

No  dv  seou  i  1  i  b  r  1  urn,   vertigo,   syncope,   seizures,   weakness  'arm(8), 
weakness  legCsl,   Paresthesias  arm(s3,  paresthesias  leg(s3,  headaches, 

EYFSt    No  problem. 

No  visual   ob  not   corrected,   esotropia,   exotrppla*  colorblindness, 
blindness,   eve  oaln,   diplopia,   hales  around  lights, 

EN^t   Frequent    rhinprrhea,    freauent  sneezing. 

No  hearing  loss,   earaches,   sinus  trouble,  postnasal   drip,  epistaxis* 
hoarseness,   carious  teeth,  bleeding  or  sore  gums,   upper  plate,  lower 
Pi «te, 

HE*RT   AND  LUNGS:   fJo  problem. 

No  heart   valve  problem,   murmur.   Irregular  rhythm,  tachycardia, 
c e rd i omega  1 y ,   wheezing,   persistent  cough,   chest  Pain,  dyspnea. 
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(CHNTINUED   QUESTIOMNiAIRE  65^321) 


Page  3 


DI^EeTIVE!    Mc  croblem. 

No  nsuseai   vomltlnai   hewatemesis*  melena»  diarrhea*  const  1  pat  1 on»  rtd 
blro^  In  stools*   indlqestlonj   abdominal  pain, 

URTN*RYl   Mo  croblem. 

No  enuresis*   Incontinence*   nocturia*   frequency*  dysuria*  hematuria* 
flant  pain  with   fever*  hesitancy, 

WO^ENt  No  P4P  tes*-  within  past  year. 

No  treast  nodule*   vaginitis*   dyspereunia*   frigidity*  Irregular 
mensds*   menorrhagia*  current  pregnancy, 

MUSCULOSKELETAL!   Joint   stiffness  due  to  Injury. 

No  neck  pain,   back  pain,   swelling  of  feet  or  lower  legs,   Joint  pain 
no*    injury  relat'ed, 

OTWEP  SVSTEwSj   Dry   skin  op  bri'ttle  nails,    Intermittent  fatigue. 

No  polydipsia*   weight   loss,   constant   fatigue*  between  meal  weakness* 
rer>iHly  growinq  mole,    rash  or  Pimples*   hot   flashes*    fever  or  chills* 
PaMi*r*   swollen  or  tender  nodes, 

FPPLTNGSi   Sadness  or  depression  -  S*   loneliness  -  S»   tenseness  ■  S*  more 
tens*  then  friends  -  M*   worries  generally  -  S*   feels  calm  and  contented  " 
N,  cn"Pulsive  -  M,   highly  sensitive  and  shy  •  8*  more  aggressive  than 
friends  -  S, 

No  suicidal   desires*   trouble  falling  asleep*   frightening  recurring 
thouohts*   Irritability,   violent   feelings*   impulsiveness*   sensitivity  to 

criticism,   gross  inadequacy,  gross  dependency*   sexual   problems,  feelings 
of  p#rsecution*   audio  hallucinations,  delusions, 

TEST<-PAST  YEAFij   No  chest   x-ray*   TB  skin  test. 

iNrOPMATION?  Exercise  programs,   health  haiards*   self-breast  exam*  medical 
emernenc 1 es , 

AOI^ITIONAL  PbSl  Section  not  marked. 
OPTNTON  OF   SYSTEMS   Section  not  marked. 


Reviewed  by 
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The  issues  raised  by  the  use  of  such  automated  history  programs  as  DASH  were 
highlighted  in  a  communication  our  project  received  from  a  nurse  who  is  serving  on 
the  privacy  committee  of  a  state  medical  records  association.     She  commented:-^^ 

"It  is  my  opinion  that  the  program  DASH  is  a  problem  in  the  area  of  automation 
of  student  medical  information.     First  of  all,  the  questionnaires  are  compiled  into 
a  problem  list  -  it  seems  that  DASH  places  in  this  problem  list  any  'Yes'  checked  by 
the  student  in  the  questionnaire,  including  such  things  as  information  requests  for 
birth  control  or  emotional  problems.     v;hat  qualifies  these  as  'Problem  areas'? 

"In  addition,  the  Problem  Monitoring  Report  strongly  violates  privacy  and 
confidentiality.     In  the  questionaire ,  the  student  is  not  told  that  such  reports  will 
be  compiled,  nor  is  the  student  told  who  will  have  access  to  the  reports  (faculty, 
counselors,  etc.).     The  Monitoring  Report  could  be  particularly  harmful  in  a  student 
health  service  where  often  times  non-professionals  are  employed,  and  who  might 
disseminate  the  information  to  unauthorized  persons.     The  sensitivity  of  the  data 
compiled  in  the  DASH  program  indicates  to  me  the  potentially  harmful  effects  of 
such  a  program. " 

A  special  problem  of  citizen  rights  posed  by  the  grov/ing  automation  of  data 
in  the  direct-care  facilities  of  colleges,  corporations,  penal  institutions  and  the 
like  is  that  the  doctors  and  other  medical  personnel  in  these  settings  are  employed 
by  organizations  that  exercise  authority  over  the  individuals  receiving  the  medical 
care — as  educator,  employer,  correctional  agency, etc.     As  the  volume  and  sensitivity 
of  the  personal  and  medical  data  in  these  computerized  files  increases — illustrated 
by  the  DASH  profile — the  issues  of  who  else  within  the  college,  company,  or 
correctional  institution  obtains  access  to  these  data  becomes  critical,  as  well  as 
issues  of  how  ancillary  uses — for  research,  service  payment  by  third  parties,  quality- 
care  assurance — and  secondary  uses — licensing,   law  enforcement,  drug  reporting, etc . — 
will  be  administered. 

ZONE  TWO:     SERVICE  PAYERS  AND  HEALTH-CARE  REVIEWERS 

Service  Payers 

We  have  already  described  the  nature  and  operations  of  the  American  health 
insurance  system.     As  we  noted,  I90  million  Americans  are  covered  by  private  health 
insurance,  75?^  in  group  plans.     About  51/5  of  this  business  is  written  by  commercial 
health  insurance  firms;  8%  by  non-profit  firms;  and  the  balance  of  U-lfo  by  the  "Blues" 
(the  71  Blue  Shield  Plans  reimbursing  for  doctors  and  office  procedures  and  73-  Blue 
Cross  plans  covering  hospitalization). 

Before  the  passage  of  Medicare  (I965)  and  the  initiation  of  Medicaid  (I966), 
automation  of  private  health  insurance,  files  had  proceeded  actively .primarily  using 
the  "batch-processing"  of  first  and  second  generation  computer  systems.     With  large 
policy-holder  files  to  record,  premium  payments  to  administer,  claims  to  process, 
and  management  reports  to  generate,  many  health  insurance  companies  were  heavy  users 
of  computers  in  the  first  decade  of  organizational  automation. 

During  the  pre-Medicare  era,  the  main  government  involvement  as  a  service  payer 
came  from  state  and  local  welfare  departments,  which  bore  the  main  burden  of 
reimbursing  doctors,  nurses,  and  hospitals  for  services  provided  to  the  indigent 
outside  of  the  public  medical  facilities. 
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After  federal  grants-in-aid  to  the  states  for  such  payments  were  initiated  in 

the  1950 's,   state  payments  to  medical  vendors  under  public  assistance  welfare 

39 

proe:rams  rose  to  $51^  million  by  I90O.        This  put  the  additional  burden  of 
information  management  for  such  payments  primarily  on  local  and  state  welfare 
agencies.     Beyond  the  minimum  financial  applications,  computerization  was  slow  in 
unfoldine-  in  government  welfare  departments  in  the  1955-1965  era,  for  reasons  that 
include  the  deeply-bred  "hand-work  and  case-work"  traditions  of  such  agencies,  a 
"Great  Society"  rather  than  management-ef f iciency  focus  in  the  I96I-65  phase,  and 
the  primacy  of  political  factors  in  local  management  of  welfare  eligibility  and 
distribution. 

The  passage  of  Medicare  and  Medicaid  radically  changed  the  automation  patterns 
in  service  paying.     As  George  A.  Ryan  has  written,   "the  rapid  influx  of  Medicare 
claims  reached  almost  unmanageable  proportions.     Notwithstanding  the  computer 
facilities  available  to  carriers,  the  data  management  problems  which  occurred  as  a 
result  of  Medicare  legislation  defied  for  a  time  efforts  on  the  parts  of  many 
carriers  to  cope  with  the  volume  of  claims  data. "^^    From  I966-67  until  recently, 
most  of  the  commercial.  Blues,  and  non-profits  were  preoccupied  with  adopting  third 
and  fourth  generation  computer  system  approaches  to  meet  these  sharp  rises  in  claims 
processing.     For  example.  Blue  Shield  claims  went  from  200  million  in  I968  to  an 
estimated  1.2  billion  in  1975.     Today,  claims  processing  consumes  about  ^0%  of  EDP 
expense  m  health  insurance  operations.         Our  profile  of  Mutual  of  Omaha  in  Part 
Three  shows  how  one  leading-edge  user  responded  to  these  dynamic  conditions  in  the 
past  decade. 

State  welfare  agencies  were  given  primary  responsibility  for  administering 
Medicaid  (^9  states  set  up  Medicaid  program.s,  with  only  Arizona  not  participating). 
While  the  state  welfare  agency  determines  eligibility,  it  has  used  fiscal 
intermediaries  (the  private  carriers)  on  a  contract-basis  to  handle  payments  to 
primary  care  providers.     State  Medicaid  information  management  of  these  operations 
has  been  weak  in  both  its  administrative  and  oversight  functions.     There  have  been 
some  federal  efforts  to  develop  a  Model  Medicaid  Management  system,  notably  with 
leading-edge  state  welfare  departments  in  a  few  states  such  as  Michigan  and  Maine. 

The  Automated  Client  Information  System  (CIS)  of  the  Michigan  Department  of 

Social  Services,  under  development  since  1970,  is  worth  describing  here.     CIS  was 

originally  conceived  as  one  of  eight  subsystems  for  improving  management  of  Michigan's 

Medicaid  Program,  but  the  system's  data  network  has  now  been  expanded  to  include 

information  on  all  residents  who  are  currently  receiving  any  form  of  state  social 

services  or  have  received  any  such  benefits  in  the  past  two  years.     The  major 

objectives  of  the  system  are  to  identify  and  enroll  individuals  in  social  service 

programs;   issue  authorization  cards  for  Medicaid;  furnish  necessary  recipient 

eligibility  information  to  Medicaid  providers;  and  centralize  maintenance  of  medical 

and  public  assistance  data. 

The  CIS  is  now  the  largest  on-line  health  and  welfare  eligibility  system  in 
42 

the  country.        Each  of  Michigan's  83  counties  is  linked  to  one  of  five  regional 
communications  centers  by  individual  video-keyboard  data  terminals     (VDT's)  located 
in  selected  county  offices,  state  offices  and  medical  facilities  and  used  to  enter 
and  receive  information  from  the  statewide  data  center  in  Lansing.     Authorized  county 
personnel  contact  the  assigned-center  VDT  operators  by  telephone  when  they  wish  to 
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submit  an  inquiry  or  update  data  stored  in  the  central  computer  facility.  Telephone 
security  checks  and  electronic  edits  are  used  to  maintain  confidentiality. 

Prior  to  the  implementation  of  the  CIS,  Michigan's  Medicaid  Program  lacked  a 
reliable  data  base  upon  which  to  make  even  fundamental  decisions  concerning 
eligibility  and  the  payment  of  bills.     Through  its  on-line  update  capabilities,  the 
system  no  longer  rejects  nearly  3,000  provider  claims  each  week  as  it  did  under  the 
old  system,  because  of  processing  lags  in  eligibility  and  re-eligibility  checks. 
The  Department  of  Social  Services  also  reports  reduction  of  administrative  and 
payment  costs,  facilitation  of  system  audits,  and  minimization  of  fraud  and 
duplication . 

From  a  citizen    rights  standpoint,  several  trends  in  automation  among  payers 
and  intermediaries  deserve  notice.     As  health  insurance  firms  are  accumulating 
automated  historical  files  on  their  policyholders,  the  level  of  personal  medical 
detail  in  these  files  has  been  widening.     With  health  costs  skyrocketing,  insurers 
and  intermediaries  are  under  pressure  to  scrutinize  claims  more  closely — 
eligibility  for  the  service  provided,  whether  the  service  is  covered  by  the  policy, 
whether  it  was  medically  necessary  and  properly  provided,  whether  the  charge  was 
within  payment  guidelines,  and  so  forth.     This  has  led  service  payers  to  insist  that 
"full  data"  be  supplied:  positive  identification  of  patient  and  medical  provider, 
exact  medical  conditions  and  services  provided,  specific  medical  diagnosis  or 
condition.     The  advent  of  PSRO  reviews,  and  the  expected  reviews  under  future 
national  health  insurance  plans,  create  additional  pressures  for  collecting  identified, 
detailed,  evaluative  data. 

Clearly  the  insurance  function  demands  that  some  medical  data  be  furnished  to 
payers,  not  only  to  determine  the  appropriate  amount  of  the  claim  but  to  monitor 
for  fraud  by  both  claimants  and  primary-care  providers.     It  is  this  demand  for  detail 
that  raises  the  issue  of  incursion  into  the  doctor-patient  relationship,  especially 
when  the  medical  condition  involves  a  socially-stigmatized  area  or  one  whose 
disclosure  could  lead  to  loss  of  opportunities  by  the  patient. 

What  has  the  extensive  computer  use  in  Zone  2  done  to  observance  of 
confidentiality  in  service  payment?    So  far,  not  much.     The  crucial  aspect  of  this 
question  is  unclear  policy  definition,  which  pertains  equally  to  manual  records. 
Generally,  charges  of  improper  leakage  of  personal  data  from  Zone  2  raise  the 
question:  Just  what  is  a  private  or  government  employer,  or  other  third  party, 
entitled  to  know  about  specific  medical  conditions  of  a  subscriber  or  claimant? 
Should  no  information  at  all  be  given  to  third  parties  on  the  ground  that  health 
insurance  firms  receive  this  information  solely  for  purposes  of  claims  adjudication? 
Or  should  group  policyholders,  v/hether , government  or  private,  be  entitled  to  learn 
of  certain  health  conditions  that  could  impair  their  employees'  job  performance  or 
make  them  ineligible  for  promotion  or  security  clearances,  etc.     The  point  to 
underscore  is  that  this  is  a  gray  area  today  in  terms  of  law  and  policy,  not  one 
on  which  law  is  clear  and  is  being  willfully  violated. 

But  while  leakages  of  confidential  medical  data  have  so  far  involved  manual 
forms,  not  computer  printouts,  there  is  little  doubt  that  patient  and  doctor 
confidence  in  automated  service  payment  will  be  impaired  if  imprecise  policies 
prevail.     The  issue  is  whether  service  payers  should  be  collecting  and/or  retaining 
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as  much  data  as  they  do  now,  given  the  fact  that  many  medical  and  civil  liberties 
commentators  feel  they  are  not  limiting  its  circulation  sufficiently  in  manual 
forms . 

Another  trend  in  automating  service-payment  mechajiisms  over  the  past  two  decades 
has  been  the  entry  of  data  processing  firms  as  intermediaries  under  Medicare  and 
Medicaid,  and  in  various  utilization  review  projects.    Among  the  best  known  of  these 
is  the  Electronic  Data  Systems  Company  (EDS)  owned  by  H.  Ross  Perot,  which  processed 
over  75  million  health  insurance  claims  in  1973  for  various  state  agencies  and  Blue 
Shield/Blue  Cross  plans.     This  lodges  personal  medical  data  still  further  away  from 
the  ethical  constraints  of  the  primary-care  providers  or  the  Blues  (which  the 
medical  and  hospital  professions  themselves  developed  and  still  influence  directly). 
Given  the  sometimes  politicized  character  of  the  contracting  process  that  has 
awarded  claims-data  contracts  to  commercial  firms,  and  the  essentially  non-medical 
character  of  these  "data  shops,"  attention  clearly  needs  to  be  paid  to  how  well 
protected  these  files  are  today  in  legal  status  and  how  securely  they  are  kept  in 
fact. 

Utilization  Reviews 

Since  health  care  is  a  complex  mixture  of  provider  institutions,  payers  and 
carriers,  and  health  agencies,  rational  administration  and  evaluation  depend  on  the 
collection  of  statistical  data  about  patients — their  demographic  characteristics, 
medical  problems,  treatment  provided,  outcome,  etc.     Such  trend  data  is  needed  to 
evaluate  medical  procedures,  plan  and  administer  individual  facilities,  and 
coordinate  local, regional,  or  state  health  resources. 

For  these  reasons,  a  number  of  medical  data  systems  have  been  developed  in 
recent  decades  that  collect  trend  information  through  sample  surveys  of  individuals, 
program-operation  data  by  private  payers  or  government  agencies,  or  case  data 
directly  from  primary  care  institutions.     Such  data  allow  institutions  and  planning 
agencies  to  analyze  and  compare  patterns  of  care,  outcome,  costs,  etc.,  and  to  do 
basic  research. 

The  most  important  example  of  such  activity  is  the  hospital  discharge  data 
system  for  in-patient  care  activity,  of  which  there  are  about  a  dozen  currently 
operating.     The  largest  of  these,  and  the  only  one  operating  nationwide,   is  the 
Professional  Activity  Study  (PAS)  of  the  Commission  on  Professional  and  Hospital 
Activities,        a  non-profit  corporation  sponsored  by  the  American  Hospital 
Association,  American  College  of  Physicians,  American  College  of  Surgeons,  and  the 
Southwestern  Michigan  Hospital  Council.     Originally  founded  in  1953 »  PAS  now 
collects  individual  case  abstracts  from  participating  hospitals  (2100  in  1975f  of 
which  1800  are  in  the  U.S.).     It  provides  a  database  used  by  the  participating 
institutions  to  evaluate  their  care  and  utilization  patterns,  and  produces  national 
or  regional  data  for  baseline  comparisons  of  many  kinds. 

Participating  hospitals  skim  off  from  their  medical  records  and  send  PAS  a  set 
of  basic  data  about  each  patient  discharged.     This  covers  a  coded  PAS  hospital 
identification,  a  patient  number  supplied  by  the  hospital,  no  patient  or  doctor 
identity  (these  are  kept  locally  by  the  contributing  hospital),  patient  demographics 
(age,  sex,  and  race),  clinical  service,  date  of  admission,  date  of  discharge,  all 
diagnoses,  all  operations,  form  of  admission,  complications,  consultations  from 


113 


other  departments,  how  discharged  or  if  died,  interservice  transfer,  source  of 
payment  (or  expected),  detailed  enumeration  of  investigations  and  examinations  done, 
drugs  used,  other  therapy,  special  unit  care,  and  (as  of  1974),  PSRO  information 
relating  to  certified  admission,  concurrent  reviev/,  and  similar  matters.     In  addition, 
space  on  the  case  abstract  is  provided  to  incorporate  additional  optional  items  that 
a  PAS  participant  may  want  to  store  and  use,  such  as  patient  residence,  type  of 
accomodation  within  the  hospital,  and  special  therapy. 

PAS  moved  into  computer  processing  in  I96I  and  now  has  almost  110  million 
individual  case  abstracts  stored  in  its  automated  database.     PAS  reports  for 
participating  hospitals  are  prepared  monthly,  semi-annually,  and  annually.  These 
provide  profiles  of  care  for  medical  evaluation,  practice  display,  medical  audit 
materials,  basic  patient  statistics,  quality  of  care  assessment,  and  similar 
purposes,  as  well  as  regional  and  national  comparisons  representing  other  PAS 
participants.     Special  options  allow  a  hospital  to  get  utilization  and  audit  reports, 
length  of  stay  studies,  study  of  patient  charges,  and  other  special  analyses. 

There  are  about  10  regional  hospital  discharge  data  systems  throughout  the 
United  States,  such  as  the  QUEST  Program  of  Northeast  Ohio,   the  Hospital  Utilization 
Project  of  Western  Pennsylvania,  the  Medical  Record  System  of  the  California  Health 
Data  Corporation,  and  the  Connecticut  Utilization  and  Patient  Information  System. 
There  are  also  projects  on  ambulatory  care  data  systems,  and  various  special-purpose 
data  systems  covering  particular  diseases,  health  conditions,  or  community  health 
center  operations. 

The  basic  confidentiality  principle  of  the  PAS  data  system  is  that  the  hospital 
retains  the  identity  of  the  patient  and  the  doctor,  with  the  case  abstract  filed 
only  by  a  number.     The  participating  hospital,  knowing  the  number,  can  have  reports 
drawn  up  on  the  basis  of  various  grouping  of  case  abstracts  along  any  line  it 
wishes,  but  PAS  employees  and  other  participating  hospitals  cannot  obtain  a  case 
abstract  with  the  name  of  a  patient  or  doctor  on  it. 

Quality  Care  Assurance 

The  1972  federal  legislation  requiring  professional  standards  review  (PSRO) 
under  F/'edicare,  Medicaid,  and  Maternal  and  Child  Health  Programs      has  led  to  the 
creation  of  a  first  wave  of  local  PSRO  organizations  sponsored  by  local  medical 
practitioners.     The  PSRO's  obtain  data  from  the  various  providers — hospitals,  HMO's, 
prepaid  medical  plans,  psychiatric  institutions,  nursing  homes,  etc.,  as  well  as 
from  fiscal  intermediaries — and  analyze  these  according  to  quality-care  criteria  to 
be  set  up  by  the  local  PSRO.     The  data  systems  being  developed  by  these  PSRO 
organizations  are  automated,  and  will  be  linked  to  the  computer  systems  of  the 
providers  and  carriers.     Basic  personal  data  to  be  included  in  a  case  review  are 
expected  to  include  patient  identification,     demographic  data  (age,  race,  sex, 
residential  area),  hospital  identification,  dates  of  service,  diagnostic  data, 
procedures  data,  patient  disposition  data,  identification  and  practice  data,  on 
attending  physician,  and  identification  and  practice  data  on  operating  physician. 

Our  project  visited  several  developing  PSRO  organizations  and  studied  the 
data-system  plans  that  they  and  others  are  implementing.     From  a  citizen  rights 
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standpoint,  basic  issues  here  involve  the  disclosure  of  patient  identity  both  in 
initial  peer  review  and  in  any  successive  appeals  that  might  be  taken  (including 
appeals  that  could  place  identified  patient  data  in  regional  or  even  national 
review  files),  as  well  as  the  patient's  right  of  access  to  the  PSRO  record. 

ZONE  THREE:     COMPUTERIZATION  OF  HEALTH  AGENCY  FILES 

Vie  noted  in  this  chapter's  Introduction  that  we  would  not  attempt  to  describe 
patterns  of  automation  in  all  the  industries  and  government  activities  that  use 
health  data  to  make  various  social  judgments  —  in  employment,  education,  licensing, 
credit,   life  and  auto  insurance,  welfare,  law  enforcement,  etc.     What  does  belong  in 
this  chapter,  however,   is  a  description  of  several  important  trends  in 
computerization  by  government  health  agencies.     vVe  are  dealing  here  not  with 
assurance  of  quality  care  by  government  (that  has  already  been  treated  in  Zone  2) 
but  with  the  general  planning,  evaluation,  and  coordination  functions  performed  by 
local,  state,  and  federal  health  agencies. 

Government  oversight  of  hospitals,  mental  health  facilities,  and  other  health 
care  centers  is  a  matter  of  overlapping  jurisdictional  responsibility  in  the  United 
States.     Given  our  mixture  of  private-f or-prof it ,  private-non-profit,  and 
government-owned  facilities,  plus  the  supplying  of  funds  to  local  institutions  by 
federal  and  state  programs,  there  is  a  mixture  of  single-agency  and  cooperative- 
an-ency  supervision  that  puts  individual  institutions  under  reporting  duties  to  various 
government  health  agencies.     Many  of  these  duties  require  only  statistical  data,  but 
many  others  call  for  the  reporting  of  identified  personal  information  about  patients, 
and  also  the  supervisory  authorities  rights  of  inspection  that  include  access  to 
personal  records. 

State  health  agencies  occupy  probably  the  pivotal  position  in  this  regulatory 

network,  having  the  primary  supervisory  authority  over  local  health  facilities  and 

also  servine  as  the  interfacing  unit  with  the  federal  government  for  most  local  and 

,  48 

state  health-assistance  programs.     In  a  survey  conducted  in  December  of  1974,  the 

National  Association  of  State  Information  Systems  found  that  of  45  states  reporting, 

state  departments  of  health  in  21  states  computerized  patient  census  files;  10  had 

patient  information  processing  applications;   10  maintained  hospital  administration 

files;  and  6  had  applications  for  medical  records.     Seventeen  of  these  state 

departments  had  their  own  computers,  while  others  had  services  supplied  by  state 

data  processing  centers. 

Another  survey  in  1974  examined  computerization  by  state  mental  health 
4q 

authorities.   ^     Out  of  47  jurisdictions  replying,  29  indicated  they  had  implemented 
computer  data  systems  that  collected  case  information  from  local  mental  health 
centers.     Twenty-three  of  these  stored  personally-identified  psychiatric  information 
in  their  files,  either  through  name  or  Social  Security  number.     The  primary  purpose 
for  such  automation  was  found  to  be  the  control  of  costs,  with  closer  scrutiny  of 
eligibility  the  key  technique.     Only  three  states — Arizona,  Colorado,  and  Utah — 
collected  no  identifying  data,  while  three  other  states  reported  that  they  were 
"moving  away  from  storing  identifiable  information"  in  these  files. 
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This  survey  found  that  "requesting  affirmative  authorization  for  computerizing 
a  patient's  personal  psychiatric  information  is  virtually  non-existent."     Only  one 
state  reported  that  local  patients  sign  authorizations  for  release  of  confidential 
information  to  the  state  automated  file,  and  another  state  said  it  obtained  patient 
permission  to  file  the  data  by  Social  Security  number,  which  is  the  identifier  used 
in  this  system.     "If  the  client  refuses  to  sign  a  release,"  this  state  said,  "the 
[locall   center  assigns  a  pseudo-social  security  number  to  that  client's  data." 

The  citizen      rights  issues  posed  by  such  state  health-agency  automation 
revolve  around  the  issue  of  whether  such  records  need  to  be  collected  and  stored  by 
the  state  with  personal  identifiers.     When  these  are  attached,  this  raises  the  issue 
of  informed  patient  consent  to  such  use;  notice  of  and  control  over  access  to  the 
records  by  other  state  agencies  (licensing  authorities,  welfare  agencies,  police, etc. 

and  rights  of  inspection  by  the  individual  patient  as  to  what  is  put  in  about  him 
or  her.     We  already  noted  (in  Part  One)  the  fight  that  has  erupted  over  the  reporting 
of  identified  case  information  by  local  health  and  mental  health  facilities  to  state 
health  or  welfare  agencies  serving  as  administrators  of  Title  XX  funds  under  the 
Social  Security  Act's  medical-aid  programs. 

One  important  new  development  in  federal  law  deserves  mention  here.     In  1975» 
Congress  enacted  the  Health  Planning  and  Resources  Development  Act,  providing  a 
ma.ior  reorganization  of  the  way  that  local  agencies  must  set  plans  for  and  coordinate 
the  use  of  federal  assistance  funds  in  the  health  field.  •^'^     The  Act  terminates  the 
existing    structure  of  regional  medical  programs  and  comprehensive  health  planning 
agencies  and  calls  for  the  creation  in  1976  of  200  health  service  areas  in  the  United 
States.     Each  will  be  administered  by  a  health  service  agency  that  can  be  a  private 
body,  a  non-profit  organization,  or  a  public  agency,  depending  on  local  option, 
though  it  must  then  have  in  it  representatives  of  the  facilities  and  agencies 
receiving  federal  aid  in  that  area.     This  has  set  off  a  lively  struggle  to  see 
whether  doctors,  hospital  administrators,  consumers,  or  local  health  officials  will 
dominate  the  new  agencies,  and  different  solutions  may  emerge  throughout  the  country. 

What  is  important  for  our  purposes  is  that  the  act  requires  each  of  the  200 
agencies  to  create  a  data  base  on  the  health  status  of  its  residents;  an  inventory 
of  local  health  facilities,  personnel,  and  services;  the  organization  and  operations 
of  the  area's  health  delivery  system ; patterns  of  utilization;  the  effect  of  that 
system  on  health;  and  its  impact  on  environmental  and  occupational-exposure 
conditions.     This  represents  perhaps  the  most  ambitious  effort  to  date  by  the  federal 
government  to  develop  comprehensive  statistics  for  evaluating  local  health  systems 
(both  as  whole  units  and  for  specific  treatment  problems)  and  to  get  a  national 
picture  of  health  conditions.     Guidelines  still  have  to  be  issued  by  HEW  as  to  how 
these  data  systems  will  operate,  but  the  issues  of  identified  versus  statistical 
data,  controls  over  data  circulation,  and  patient  access  clearly  lie  ahead. 
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A  NOTE  ON  PHOTODUPLI CATION  AND  CITIZEN  RIGHTS 


Thoueh  our  primary  focus  in  this  Part  has  been  on  computers,  we  must  stress 
that  there  is  another  important  information  technology  that  is  affecting  health-care 
records  and  citizen    rights — photoduplication .     Until  the  1960's,  most  hospital 
patient  records  were  kept  as  original  paper  documents.     V/hen  third  parties  wanted 
copies  of  these  records,  for  claims  purposes,  litigation,  etc.,  the  medical  record 
department  would  abstract  the  relevant  portions  of  the  document,  with  only  rare  use 
of  the  cumbersome  and  expensive  photostating  method.     Records  were  also  subject  to 
the  control  of  sign-out  and  sign-in  procedures.     With  the  I960's,  xerography 
arrived;  today,  it  is  estimated  that  over  70?o  of  hospital  medical  record 
departments  own  photocopying  equipment,  and  supplying  photocopies  of  records  has 
become  standard  procedures.     Microfilming  also  arrived  in  the  I960's,  and  as  space 
problems  became  more  acute  and  costs  of  microfilming  went  down,  many  hospitals  put 
their  records,  especially  inactive  records,  onto  microfilm  storage. 

The  importance  of  these  trends  in  photoduplication  for  citizen  rights  is  that 
the  pressures  on  medical  record  administrators  to  comply  with  requests  by  service 
payers,   insurance  companies,  and  government  reviewers  often  leads  them  to  photocopy 
or  make  a  microfilm  print  of  the  entire  medical  record,  or  at  least  an  entire  page, 
even  though  the  information  requested  by  a  third  party,   or  to  which  such  party  is 
properly  entitled,  may  only  be  a  portion  of  the  patient  record.     The  costs  of 
locating  the  relevant  data,  masking  out  parts  not  pertinent,  and  explaining  such 
procedures  to  the  requesting  parties  are  often  more  than  overworked  records 
departments  can  expend.     In  addition  some  medical  record  departments  allow  service 
payers  and  insurers  who  can  show  patient  release  forms  to  come  to  the  record 
library  and  do  the  photocopying  themselves,  paying  for  the  use  of  the  hospital's 
photoduplicating  equipment.     Where  this  is  done,  such  third  parties  handle  the 
patient  records  themselves,  and  the  capacity  for  breaches  of  confidentiality  are 
increased.     Also,  when  persons  with  a  right  to  sign  out  records  take  them,  the 
ubiquity  of  photocopying  machines  leads  to  an  inability  to  control  copying,  and 
further  copying  from  those  copies. 

Health  records  administrators  have  recently  criticized  such  developments  as 
jeopardizing  confidentiality.     But  they  note  that  the  tremendous  increases  in 
required  reporting,  the  shortage  of  staff  to  apply  more  restrictive  procedures,  and 
the  widespread  use  of  sweeping  patient  releases  ("supply  any  and  all  hospital 
records...")  make  it  difficult  for  the  record  administrators  to  deal  with  this  trend 
on  their  own.-^^ 

SUMMARY 

Computerization  of  personal  medical  information  has  been  marked  so  far  by 
haphazard  growth;  it  has  not  developed  according  to  thoughtfully  conceived  plans  for 
achieving  integrated  health  information  systems  within  individual  facilities  or 
throughout  the  health  care  field.     At  the  same  time,  policy  as  to  the  citizen 
rights  issues  of  privacy,  confidentiality,  and  access  is  also  developing  on  an 
individual,  ad  hoc  basis,  for  the  most  part  simply  carrying  over  into  computerized 
files  the  same  practices  pursued  with  mamual  records.     The  basic  concern  of  health 
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care  professionals,  civil  liberties  observers,  and  computer  experts  is  this: 
given  the  more  detailed,  more  centralized,  more  permanent,  more  easily-transmissible 
quality  of  computerized  medical  records,  the  flawed  procedures  and  policies 
currently  employed  with  respect  to  manual  records  threaten  to  be  seriously 
inadequate  to  the  computer  era. 
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INTRODUCTION 

Having  mapped  the  general  trends  in  computerization  of  medical  data,  we  turn 
now  to  profiles  of  six  organizations  currently  involved  in  automation  projects. 
These  are: 

1.  Los  Angeles  County  Medical  Center j 

2.  Martin  Luther  King  Jr.  Health  Center,  in  New  York  City; 

3.  Kaiser  Permanente  Health  Plan,  Oakland,  California; 

4.  U.S.  Indian  Health  Service? 

5.  Mutual  of  Omaha  Insurance  Company; 

6.  Multi-State  Psychiatric  Information  System,  in  Rockland  County, New  York. 

Our  purpose  in  presenting  these  case  studies  is  to  explore  how  organizational 
factors,  especially  choices  as  to  health-care  goals  and  administrative  philosophies^ 
are  shaping  both  the  utilization  of  computer  technology  and  the  consideration  of 
citizen  rights. 

As  to  computer  utilization,  producing  detailed  profiles  is  important  because  the 
deployment  of  computing  and  communication  resources  is  still  essentially  a  matter  of 
organizational  artistry,  not  management  science.     The  development  of  computer  systems 
requires  managers  to  exercise  choice  in  selecting  the  files  and  data  flows  to 
automate,  arranging  configurations  of  hardware  and  terminals,  writing  software, 
defining  operator-machine  relationships,  setting  patterns  of  data-sharing  inside  and 
outside  the  organization,  deciding  on  levels  of  organizational  monitoring  and 
report ingj and  choosing  the  type  of  individual  consent  and  patient  access,  if  any, 
that  data  subjects  will  be  given.     Understanding  such  choices  is  greatly  aided  by 
analyzing  how  real  organizations  have  approached  such  matters  during  the  past  decade. 

From  a  citizen  rights  standpoint,  the  importance  of  doing  profiles  lies  in 
tracing  how  issues  of  privacy,  confidentiality,  and  individual-access  were  treated 
by  these  organizations  before  they  moved  into  automation;  how  computer  use  has 
affected  those  practices;  how  on-going  changes  in  Americem  law  and  social  norms  are 
affecting  management  practices;  and  what  problems  and  issues  of  citizen  rights 
are  currently  unfolding  in  these  organizations,  or  can  be  seen  looming  ahead  as 
computerization  expands. 

Four  of  these  organizations  are  primary-care  providers  in  our  Zone  1  category; 
one  is  a  Zone  2  private  health  insurer;  and  the  sixth  is  a  Zone  3  research 
organization.  , 

While  it  is  impossible  to  reflect  all  the  significant  variables  among  health- 
care organizations  in  six  profiles,  we  have  tried  to  include  most  of  the  important 
ones.  The  following  chairt  gives  a  preliminary  overview  of  these: 
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CHARACTERISTICS  OF  PROFILED  ORGANIZATIONS 


ORGANIZATION 

CLIENTELE  : 

)WNERSHIP 

TYPE  OF 

COMPUTER 

USE 

aUALITY  OF 
HEALTH  CARE 
OR  SERVICE 

TREATMENT 
OF 

CITIZEN 
RIGHTS 

LIKELY 

PROSPECTS  IN 
COMPUTER- 
IZATION 

L.A.  COUNTY 
HOSPITAL 

Urban  Poor, 
Minorities 

Public, 

County- 

•Mainstream" 

Good 

Emergency 
Facilities, 
Average  For 
Other 
Services 

Fair 

To 
Weak 

Continued 
Mainstream 

MARTIN  LUTHER 
KING  CENTER 

Urban  Poor, 
Minorities 

Private  , 
Federal- 
Funded 

"Mainstream" 

Good  and 
Innovative 

Good 
To 

Excellent 

Cfantinued 
Mainstream 

KAISER  HEALTH 
PLAN 

Middle- 
Class,  and 
Unionized 
Workers 

Private , 
Non- 
profit 

Advanced 

Excellent 
and 

Innovative 

Good 

Continued 
Pioneering 

INDIAN  HEALTH 
SERVICE 

Rural  Poor 

Public, 
Federal 

Advanced 

Innovative 
But  Weak  In 
Outcomes 

Fair 

Future 
Uncertain 

MUTUAL  OF 
OMAHA 
INSURANCE 

Primarily 
Middle  and 
Upper  Class, 
Some  Lower- 
Middle. 

Private , 
Profit 

Advanced 

Innovative 
and  Strong 
As  Insurer 

Good 

Continued 

Advanced 

Use. 

MULTI -STATE 
PSYCHIATRIC 
INFORMATION 
SYSTEM. 

Multi-Class, 
in  Differenl 
User 

Facilities 

Public , 
;  State 

Advanced 

Innovative 
In  Systems- 
Development 
Work. 

Good 

Probably 

Continued 

Pioneering 
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To  develop  the  profiles,  our  project  reviewed  patterns  of  automation  with 
marketing  experts  from  three  computer  manufacturers.     We  also  collected  published 
descriptions  of  over  I50  organizations.     Once  we  had  made  our  selections,  we  wrote 
to  the  organizations  describing  our  project  and  asking  to  do  a  site  visit  to  them. 

After  materials  about  each  organization  had  been  assembled  and  studied,  a  team 
of  staff  members  visited  the  organization  during  197^  and  1975,  usually  for  an 
initial  visit  of  2  days  with  follow-up  visits  and  telephone  calls  as  needed.  A 
draft  profile  was  prepared  and  sent  back  to  each  orgamization  so  that  facts  could  be 
checked  and  policies  further  explained.     Updating  of  developments  for  all  six 
organizations  was  done  through  February  of  1976.     The  organizations'  managers  were 
not  asked  to  approve  the  descriptions  or  judgments  presented r  what  appears  here 
represents  the  views  of  the  project  teams  who  did  the  initial  write-ups,  and  the 
project  director,  who  did  the  final  revisions  and  rewriting. 

After  each  profile,  we  have  made  some  observations  about  the  key  citizens  rights 
issues  posed  by  the  health-care  philosophy  and  computer  usage  of  that  organization. 
These  serve  as  flags  for  our  main  policy  discussions  and  recommendations,  which  are 
saved  for  the  last  chapter  of  this  report. 
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CHAPTER  5 .    LOS  ANGELES  COUNTY  MEDICAL  CENTER 


The  Los  Angeles  County  Medical  Center  serves  the  urban  poor.    Like  many  other 
governmental  institutions  in  the  city,  it  struggles  against  the  burdens  of  underfi- 
nancing,  personnel  shortages,  overcrowding,  and  a  medically-harmful  physical  and 
social  environment.     In  terms  of  citizen  rights,  it  is  part  of  the  current  urban 
governmental  system,  one  more  institution  that  has  come  under  attack  for  infring- 
ing upon  peoples '  rights  in  the  name  of  doing  them  good  or  providing  them  with  social 
services.    While  not  among  the  most  advanced  computer  users,  Los  Angeles  has  been 
developing  a  patient  data  bank  that  was  planned  to  bring  significant  improvements  to 
patient  care  and  education.    How  its  computer  use,  and  its  general  administrative 
policies,  affect  citizen  rights  will  be  the  focus  of  our  profile. 

Background 

Medical  Center  is  part  of  the  Los  Angeles  County  Hospital  system,  which  serves 
the  500  square  miles  of  the  city  and  its  surrounding  municipalities.     It  dates  back 
to  1878,  when  it  was  begun  as  the  Los  Angeles  County  Hospital  and  Poor  Farm,  with  a 
100  bed  facility.     Today,  with  any  of  the  county's  7  million  residents  legally  en- 
titled to  reserve  care,  the  system  has  nine  county  hospitals  and  eleven  outpatient 
clinics  and  rehabilitation  centers,  as  well  as  62  clinics  run  by  the  Community  Health 
Service.     In  fact,  most  of  the  county  patients  are  poor  and  members  of  racial  minority 
groups;  those  who  cannot  afford  either  private  physicians  or  private  health  plans. 
Only  for  emergencies  (such  as  auto  accidents)  and  for  specialized  care  (communicable 
diseases)  does  the  County  system  serve  the  middle  class  as  well. 

The  Medical  Center  is  composed  of  four  hospitals*in  East  Central  Los  Angeles, 
with  beds  for  2,000  patients.     It  is  a  huge  complex:  over  90,000  patients  admitted  a 
year  and  850,000  outpatients.     It  employs  more  than  1,000  interns,  residents,  and 
full  time  physicians;  70?S  of  these  are  interns  and  residents  from  the  University  of 
Southern  California  Medical  School,  with  which  the  center  is  affiliated  as  a  teaching 
institution.     The  center  also  has  1,800  nursing  personnel  and  over  5,000  other  health 
workers.     The  labs  complete  more  than  7  million  test  measurements  each  year,  includ- 
ing more  than  1 ,400  X-rays  every  day.    About  20,000  surgical  procedures  are  performed 
in  a  year.     In  1975,  the  center's  budget  was  approximately  $500  million. 

The  Los  Angeles  County  System,  like  many  local-government  hospital  systems, 
has  been  criticized  in  recent  years  for  not  providing  adequate  care  and  for  showing 
insufficient  respect  for  patients'  dignity  in  processing  them  through  the  hospital. 
In  1970,  for  example,  a  group  of  interns  and  residents  charged  that  lack  of  care  at 
the  Medical  Center  had  resulted  in  unnecessary  patient  deaths  ar.d  injuries. 

♦General  Hospital,  Women's  Hospital,  Pediatric  Pavilion  and  Psychiatric  Hospital. 
The  total  inpatient  adiaissions  for  Los  Angeles'  nine  hospitals  in  1974  was  almost 
200,000  and  over  1.8  million  outpatient  visits.     It  has  over  2  million  square  feet 
of  hospital  space  and  a  total  staff  of  3,000  physicians,  2,000  students,  2,000  nurses, 
and  8,500  employees. 
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The  County  Hospital  Commission  investigating. the  charges  concluded  that  they  were 
exaggerated,  but  acknowledged  that  serious  patient  care  problems  did  exist.  More 
recently,  a  study  commission  found  that  while  the  general  level  of  care  was  adequate, 
it  was  not  evenly  distributed  throughout  the  county,  and  discouraged  people  in  poor 
areas  from  securing  the  kind  of  routine  care  they  need.    Criticisms  of  fiscal  mis- 
management have  also  been  raised.    Hospital  officials  respond  that  the  County  Hospital 
system  has  corrected  the  problems  cited  by  its  staff,  and  does  a  good  job  considering 
how  severely  funds  are  limited  to  it.    They  also  maintain  that  its  administration  is 
basically  good,  and  better  than  at  most  municipal  or  county  hospitals.     Both  hospital 
physicians  and  the  system's  critics  agree  that  emergency  care  at  the  Medical  Center 
is  excellent. 

The  County  hospital  system  has  a  budget  of  approximately  $300  million.  Less 
than  \0%  of  this  comes  from  out-of-pocket  payments  by  patients  or  the  private  insur- 
ance coverage  they  pay  for.  The  remainder  comes  from  taxpayers,  either  through  di- 
rect County  support  or  state  and  federal  programs  such  as  Medicare  and  MediCal.  In 
recent  years,  the  hospital  has  felt  increasing  pressure  from  the  County  to  pass  the 
costs  of  care  on  to  individual  patients  or  to  state  and  federal  programs  for  which 
they  are  eligible,  and  this,  as  we  will  see,  has  affected  computer  uses  there. 

Computer  Development  at  Los  Angeles  Medical  Center 

Between  1962  and  1966,  several  studies  of  health  information  system  possibili- 
ties for  the  Los  Angeles  area  produced  plans  for  a  pilot  data  bank  project  at  the 
Los  Angeles  Medical  Center.    An  on-line  admissions  system  went  into  operation  there 
in  late  1968,  and  was  adopted  by  the  county  hospitals  by  1970. 

The  project  had  four  objectives  at  this  point: (1)  to  capture  all  patient  data 
and  utilize  the  system  primarily  for  patient  care  and  research  rather  than  the  more 
usual  financial  and  administrative  objectives;  (2)  to  develop  the  problem-oriented 
medical  record  pioneered  by  Dr.  Lawrence  Weed;  (3)  to  develop  a  MedicAlert  system  to 
flag  by  terminal  a  warning  of  pre-existing  conditions  whenever  a  patient's  record  was 
called  up;  and  (4)  to  provide  the  basis  for  linking  the  Center's  medical  data  with  out- 
side health  agencies  for  research,  evaluation,  and  planning  purposes. 

Creation  of  a  Patient  Data  Bank  and  achieving  terminal  communication  among  the 
nine  county  hospitals  became  the  main  emphases  of  the  plan  in  the  early  1970*8, 
through  a  gradual  accumulation  of  records  and  a  "modular  growth"  of  computer  applica- 
tions.   By  1972,  about  half  of  the  County's  2.5  million  records  were  computerized, 
with  860,000  of  the  Medical  Center's  1  million  records  on  the  computer.  Admissions 
and  Laboratory  applications  were  the  first  to  be  developed,  followed  by  a  fiscal 
system  and  a  pharmacy  application. 

Funding  for  the  computer  project  has  come  from  Los  Angeles  County,  not  outside 
sources.  It  averaged  $3.5  million  annually  from  1968  to  1970,  and  about  $5.5  million 
since  1971 . 

Basically,  the  Medical  Center  computer  project  produced  computer-assistance 
for  what  is  still  essentia3J.y  a  manual  record  system,  using  paper  records,  shelves, 
file  cabinets,  and  messenger  services.     To  understand  how  this  system  works,  we  look 
first  at  the  admissions  process  and  then  the  use  of  patient  records  within  the  hospi- 
tal for  treatment  purposes. 
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The  Admissions  Process 

When  a  patient  enters  the  Center,  either  through  the  emergency  room  or  admit- 
ting area,  an  admissions  clerk  secures  as  much  identifying  information  as  possible: 
name,  address,  race,  sex,  mother's  maiden  name,  religion,  birthdate  and  marital  status. 
Social  Security  number  and  driver's  license  number  are  collected  to  serve  as  back-up 
identifiers.     If  the  patient  already  has  a  hospital  identification,  a  Medicare  or 
MediCal*card ,  or  an  enrollment  card  from  a  private  insurance  plan,  the  clerk  notes 
the  numbers. 

Identification  information  from  the  Patient  Information  Form  is  then  entered 
into  a  computer  system  via  one  of  the  video-display  terminals  in  the  admitting  area. 
Six  to  ten  seconds  later,  the  screen  displays  a  list  of  names,  addresses  and  birth- 
dates  of  recent  past  patients  who  most  closely  match  the  new  patient.     The  clerk  looks 
for  a  close  match,  and  if  he/she  finds  one,  prints  the  information  about  that  patient 
on  the  Application  Record  and  makes  any  necessary  corrections  of  the  permanent  record 
(e.g.  change  of  address). 

This  Identification  system  contains  more  than  1-^  million  names.    Roughly  40^5 
of  the  in-patient  admissions  are  identified  as  having  previously  been  to  a  county 
hospital  facility.    If  the  patient  is  not  identified  as  having  been  a  previous  County 
patient,  the  clerk  calls  the  identification  section  of  the  Medical  Records  Department 
and  gets  a  new  record  number  for  the  patient. 

The  primary  purpose  of  the  Admissions/identification  system  is  to  determine 
what  individual  or  agency  will  pay  for  the  patient's  medical  care.    The  need  for  an 
immediate  determination  of  who  will  pay  must  be  seen  in  the  context  of  how  the  Medical 
Center  is  financed: 

1.  Private  payment:    Only  10%  of  the  patients  have  private  insurance  or  suffi- 
cient income  to  cover  all  their  bills.     The  bills  are  substantial:  outpatient  treat- 
ment in  1974-75  was  billed  at  roughly  $30  a  day  plus  the  cost  of  lab  tests,  prescrip- 
tions and  other  "extras";  inpatient  treatment  averaged  $184  a  day,  with  surgery  billed 
at  $290  a  day,  intensive  care  $420,  and  psychiatry  $165. 

2.  Medicare/MediCal;    Approximately  55?^  of  the  patients  are  enrolled  in  Medi- 
care or  MediCal.    The  Social  Services  Department  fills  out  the  appropriate  forms  for 
these  programs,  copies  of  which  go  to  the  agencies  involved.     The  patient  is  billed 
for  any  deductible  portion  that  is  not  covered  by  these  agencies  and  the  agency  is 
billed  for  the  rest. 

3.  County  Support;    Approximately  35?^  of  the  patients  are  not  enrolled  in 
either  a  federal  or  state  program  and  claim  they  cannot  afford  to  pay  out  of  private 
insurance  or  their  personal  income.    The  funds  to  support  the  care  of  these  patients 
come  from  the  tax  revenues  of  Los  Angeles  County. 

There  is  strong  pressure  from  the  County  to  reduce  its  355^  support  by  (a)  iden- 
tifying every  possible  patient  who  is  eligible  for  either  state  or  federal  aid,  and 
(b)  collecting  fees  from  all  those  who  are  ineligible  and  have  some  financial  re- 
sources.    The  collection  of  identifying  data  upon  admission  and  the  comparison  with 
the  past  hospital  record  is  the  first  step  in  assuring  accomplishment  of  these  two 
ends. 

*hediCal  is  California's  state  supplement  to  Medicare. 
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Where  the  patient  is  not  covered  ty  state  or  federal  programs ,  an  effort  is 
made  by  a  Financial  Services  Worker  in  a  personal  interview  to  find  out  whether  the 
patient  is  eligible  for  either  by  collecting  information  as  to  his/her  financial  re- 
sources, including  income,  personal  and  real  property,  savings  and  other  assets, 
which  the  patient  must  swear  to  and  document  by  the  production  of  pay  stubs,  bank 
books  and  other  records.    Patients  who  are  eligible  for  federal  assistance  and  who 
earn  too  much  money  to  qualify  for  county  assistance,  or  who  refuse  to  provide  the 
necessary  financial  information,  are  billed  in  full  for  hospital  services,  on  an 
installment  basis  if  necessary. 

Since  June  of  1975»  Medical  Center  hospitals  have  been  tied  into  a  commercial 
billing  service  operated  by  the  McDonald-Douglas  Corporation.    Information  is  ex- 
tracted from  the  admissions  forms  and  entered  into  this  system  via  computer  termi- 
nals in  the  business  office  of  each  hospital.     The  information  is  processed  in  Peoria, 
Illinois,  and  bills  for  insurers  and  patients  are  printed  out  at  the  hospital.  In 
addition,  daily  census  reports  are  prepared  for  each  ward  and  a  variety  of  statistic- 
al reports  are  produced  for  administrative  purposes. 

As  it  now  stands,  the  billing  system  contains  information  on  each  patient's 
age,  sex,  race,  family  background,  ward  and  source  of  payment — in  addition  to  basic 
identifying  information.     In  the  future,  according  to  Medical  Records  Director  Bliss, 
the  system  will  also  contain  information  on  diagnoses  and  medical  procedures — the 
full  range  of  medical  information  required  for  reporting  to  insurers  and  government 
agencies . 

The  unpaid  bills  of  patients  are  turned  over  by  the  Center  to  the  County  Bu- 
reau of  Resources  and  Collections,  whose  functions  include  collecting  delinquent  hos- 
pital bills  for  the  entire  hospital  system.     The  Bureau  pressures  the  patients  to  pay, 
and  where  this  doesn't  succeed,  they  refer  the  matter  to  the  County  Counsel's  office, 
which  can  take  the  patient  to  court,  attach  personal  property,  or  place  a  lien  on  the 
patient's  house  or  land.    Because  this  is  time-consuming,  it  is  done  on  a  selective 
basis,  primarily  to  give  credibility  to  the  enforcement  process. 

Medical  Records  and  Admissions  workers  estimate  that  about  3%  of  patients  give 
false  names  and/or  addresses,  and  only  occasionally  will  such  false  identities  be  un- 
covered. Some  patients  do  this  because  they  are  afraid  of  the  hospital  bills,  others 
fear  deportation  as  illegal  aliens ,  and  still  others  do  not  want  to  be  stigmatized  by 
an  illegitimate  birth  or  venereal  disease. 

Despite  current  collection  efforts,  reimbursement  for  County  medical  services 
remains  a  chronic  problem.     In  July  of  1974,  the  Audit  Committee  of  the  County  Grand 
Jury  handed  down  a  report  criticizing  the  Bureau  of  Resources  and  Collections.  The 
report  noted  at  least  $2  mi2J.ion  outstanding  in  delinquent  hospital  bills,  and  sin- 
gled out  Medical  Center's  Emergency  Room  billings  as  being  in  particular  need  of  im- 
provement.    The  report  called  for  more  effective  collection  procedures  to  be  estab- 
lished, such  as  billing  emergency  room  patients  at  the  time  of  treatment  and  more 
quickly  identifying  those  eligible  for  MediCal. 
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It  should  be  noted  that  the  Medical  Center  must  accept  any  acutely-ill  patient, 
regardless  of  financial  condition.     The  Center  has  tried  to  delay  treatment  in  non- 
emergency cases  until  it  found  out  who  was  going  to  pay  for  it.  "This  was  abandoned," 
said  John  McClurg,  the  Center's  Medical  Service  Administrator,  "because  the  addition- 
al revenues  we  got  by  this  method  didn't  balance  against  making  the  patient  wait 
longer. " 

In  addition  to  its  payment  function,  the  admitting  form  also  serves  medical 
purposes,  and  these  have  been  enhanced  by  computerization.    For  example,  the  Center 
has  special  information  on  8,000  Medi-Alert  patients  which  can  be  printed  out  on  the 
application  record;  this  warns  the  staff  about  these  patient's  special  medical  pro- 
blems.    If  a  patient  is  a  diabetic,  for  instance,  a  code  number  appears  on  the  Ap- 
plication Form  that  places  the  patient  in  a  special  ward.    Or  if  a  patient  has  a 
pacemaker,  a  phone  number  will  be  provided  for  special  instructions. 

The  Patient's  Medical  Record  Within  the  Hospital 

When  the  admission  procedure  is  completed,  copies  of  the  application  record 
are  sent  to  the  Department  of  Medical  Records,  the  Chaplain's  Office,  the  Data  Pro- 
cessing division,  and  Patient  Billing.     It  is  also  attached  to  the  patient's  chart  - 
a  collection  of  laboratory  reports,  X-Ray  results,  diagnoses,  etc.  -  which  is  com- 
piled for  immediate  use  while  the  patient  is  at  the  hospital.     These  individual  pa- 
tient records  are  kept  manually. 

A  physician  may  call  for  a  previous  patient  record  stored  in  the  record  center 
to  be  produced  for  use  in  this  treatment  episode.     This  is  not  done  automatically, 
however.    According  to  Andrew  Bliss,  Director  of  Medical  Records,  physicians  request 
a  search  for  prior  records  on  only  a  third  of  their  patients.     There  are  several  rea- 
sons given  for  this  limited  use  of  past  records: 

1 )  They  are  not  always  delivered  as  fast  as  the  physicians  need  them,  al- 
though Medical  Records  Director  Bliss  states  that  they  are  usually  delivered  "within 
thirty  minutes  after  a  request  is  made." 

2)  The  needed  information  must  be  laboriously  extracted  from  the  collection 
of  paper  forms,  notes  and  X-rays  that  make  up  the  patient's  permanent  medical  record. 
"Right  now,  we  have  no  economical  way  to  do  this,"  reports  Professional  Services  Di- 
rector Sol  Bernstein.    A  survey  by  the  Chief  Registrar  of  the  Center  indicated  that 
even  when  the  past  record  is  requested,  physicians  on  the  ward  look  at  only  5%  of 
the  items  on  the  chart. 

3)  Identification  problems  sometimes  result  in  the  wrong  record  being  deliv- 
ered or  information  on  more  than  one  patient  being  included  in  the  same  record. 

4)  Physicians  often  will  not  accept  the  "work-up"  done  on  a  patient  prior 
to  the  current  admission.     Dr.  Bernstein  points  out  that  "A  physician  here  will 
order  a  new  work-up  even  if  the  person  was  recently  a  patient  in  his  own  hospital. 
It's  a  combination  of  careful  medicine  and  mistrust  of  the  other  man's  work." 

Some  of  these  difficulties  are  reflected  in  the  findings  of  outside  review 
bodies.     In  1972,  the  Joint  Commission  on  Hospital  Accreditation  withheld  the  Medi- 
cal Center's  normal  2-year  accreditation.     The  decision  was  based  in  part  on  record- 
keeping shortcomings,  including  failure  by  physicians  to  sign  requests  in  patients' 
files  for  treatment  and  X-rays,  failure  to  complete  discharge  summaries  and  opera- 
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tion  reports  on  time,  and  failure  to  establish  a  sufficient  number  of  audit  committees 
for  internal  review  of  the  staff's  work.    A  year  later,  however,  the  Commission  found 
many  of  the  record-keeping  deficiencies  corrected.     The  State  Department  of  Health,  in 
reviewing  the  Medical  Center,  has  also  commented  on  improperly  signed  orders  for  treat- 
ment and  failures  to  identify  patients  accurately. 

Whether  the  chart  is  a  new  one,  or  one  continued  from  a  previous  stay,  this 
chart  follows  the  patient.     If  the  patient  is  admitted  to  a  ward,  the  chart  is  deliv- 
ered there,  and  is  stored,  on  a  rack  outside  the  nursing  station.     If  the  patient  moves 
to  another  ward,  the  chart  follows  along.     "We're  talking  about  an  enormous  demand  here 
...moving  hundreds  of  large  records  around  every  day,"  comments  Mr.  Bliss. 

The  Growth  of  Computer  Use  at  the  Medical  Center 

Why  did  Los  Angeles  County  move  into  electronic  data  processing?    In  the  late 
1950's,  the  Medical  Center  began  to  convert  its  payroll  and  patient  billing  from  manual 
to  machine  processing.     "As  the  workload  grew,"  said  G-ene  Thompson,  Chief  of  the  Health 
Information  System,  "they  just  kept  developing  along  proven  lines,  adding  more  of  the 
same  kind  of  equipment  until  they  had  a  big  tab  shop  with  perhaps  75  people." 

In  1968,  following  acceptance  of  the  computer  studies  mentioned  earlier,  the 
Medical  Center  acquired  an  IBM  360/40  and  began  converting  its  admissions  system.  By 
the  end  of  the  year,  on-line  records  for  65,000  patients  were  available  at  the  Medical 
Center  via  twelve  terminals.    Developing  this  system  did  not  involve  converting  much 
of  the  data  from  existing  manual  files  but  was  designed  to  build  its  own  data  base 
over  time.    Use  of  the  system  created  the  list  of  past  admissions  against  which  current 
patient  identifiers  are  checked. 

In  1969,  the  Data  Processing  Department  began  to  expand  the  system  beyond  the 
Medical  Center  complex  to  all  nine  county  hospitals,  and  to  the  present  120  terminals 
and  almost  two  million  patient  names.     The  MedicAlert  previously  mentioned  was  created. 
A  variety  of  administrative  and  statistical  reports  are  also  generated  from  data  al- 
ready in  the  system  or  especially  in-put  for  processing. 

In  addition  to  the  functions  of  the  main  computer,  several  stand-alone  computer 
systems  developed  independently.    Among  the  separate  systems  are:   (1)  processing  and 
reporting  blood  gas  analyses  and  electrocardiograms; (2)  keeping  track  of  X-rays; 
(3)  patient-monitoring  at  Women's  Hospital; (4)   scheduling  clinic  appointments; (5)  keep- 
ing track  of  the  hospital's  2,000  non-resident  attending  physicians;  (6)  keeping  track 
of  prescriptions  aind  drug  use  in  the  pharmacy;  (7)  monitoring  vital  signs  in  the  cardiac 
intensive  care  unit;  (8)    statistical  and  administrative  information  about  patients  with 
communicable  diseases  and  mental  health  problems. 

According  to  the  Health  Information  System's  chief.  Gene  Thompson,  most  of  these 
systems  developed  out  of  very  specific  needs  and  were  "shepherded  by  one  or  two  people 
who  could  make  a  case  for  getting  the  money.    Almost  all  of  them  were  developed  in- 
house  in  an  ad-hoc  fashion.     They're  not  part  of  some  grand  design." 

Lack  of  research  and  development  money  seems  to  be  the  chief  reason  for  this  ad- 
hoc  development  of  computerization.    Mr.  Thompson  recalls  that  "...we  had  to  develop 
applications  that  showed  pay-off  because  most  of  the  money  for  development  came  out  of 
the  County.    Even  though  the  environment  in  the  County  was  pretty  encouraging  for  EDP 
—  Medicare  and  MediCal  dollars  had  just  started  flowing  in           we  had  to  develop  very 
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practical  applications.    We  knew  from  the  beginning  that  we  were  going  to  develop  a  sys- 
tem that  would  grow  slowly  and  that  would  change  over  time.  This  kept  us  from  even  think- 
ing about  putting  it  all  together  in  one  big  'hospital  information  system.'" 

Both  McClurg  and  Thompson  point  to  a  second  constraint,  in  addition  to  the  lack 
of  money,  -  the  early  focus  on  serving  multiple  hospitals  made  them  reject  the  idea  of 
building  a  system  to  handle  all  the  records  on  all  patients.     "There  was  just  too  much 
there;  it  was  clearly  too  complex  to  do  all  at  once,"  said  Thompson.     "So  we  thought  in 
terms  of  being  able  to  do  the  job  both  manually  and  on  the  computer.    We  vowed  never  to 
try  and  replace  the  whole  chart." 

Hospital  personnel  interviewed  believe  that  the  computers  save  time,  improve  re- 
cord-keeping accuracy,  and  provide  better  administrative  handling  of  patients  and  their 
records.    As  to  the  Admissions/identification  system,  Thompson  states  that  "The  average 
admission  time  has  been  cut  from  15  minutes  to  five  or  six... In  addition,  admissions 
forms  which  go  into  the  patient's  chart  are  more  standardized  axid  have  fewer  errors  than 
in  the  past."    Computerization  has  also  enabled  County  hospitals  to  achieve  some  limited 
cross-referencing  of  patient  files.    One  of  the  early  problems  encountered  was  that  a 
clerk  in  one  hospital  was  able  to  introduce  errors  into  the  files  of  another  hospital. 
When  this  kind  of  error  reached  intolerable  levels,  the  system  was  changed  so  that  a 
terminal  user  in  Hospital  A  could  read  but  could  not  add  to  or  alter  the  identification 
files  of  Hospital  B. 

Since  the  Admissions/Identification  system  links  separate  medical  records,  but 
does  not  create  a  consolidated  record  from  several  sources,  its  operation  has  had  little 
effect  on  the  accuracy  of  those  medical  records  which  still  depend  upon  manual  entries. 
A  review  of  the  Medical  Center  computer  system  found  that:     "Level  of  efficiency  in  link- 
age was  considered  good,  but  only  as  good  as  the  actions  of  people  who  back  up  the  sys- 
tem and  the  quality  of  the  service  given  as  a  result.     Quick  and  accurate  reference  to 
the  medical  record... was  considered  futile  if  the  record  was  not  completed  accurately, 
not  filed  currently  in  an  accessible  manner,  and  not  deliverable  within  a  minimal  time 
lapse." 

Two  important  medical  applications  currently  being  developed  are  a  laboratory 
data  management  system  eind  an  expanded  pharmacy  system.     The  laboratory  system,  under 
development  for  the  past  six  years,  includes  both  analogue  aind  digital  processing.  The 
labs  at  the  Medical  Center  are  now  fully  automated  and  hospital  officials  describe  them 
as  the  largest  clinical  testing  complex  in  the  country.    Over,  1 ,400  kinds  of  tests  are 
performed,  for  a  total  of  7i  million  procedures  each  year.     The  diversity  and  volume 
have  proven  difficult  to  handle,  but  Thompson  expected  that  a  system  to  print  out  lab 
results  summaries  on  demand  in  the  admitting  and  emergency  areas,  and  report  these  to 
the  patient's  chart  would  be  ready  by  the  end  of  1975.    At  first,  this  system  will  serve 
only  the  Medical  Center,  but  will  ultimately  be  expanded  to  all  the  acute  hospitals. 

The  goal  of  the  pharmacy  system  is  to  focus  the  physician's  attention  on  over-use 
of  particular  drugs,  bad  drug  combinations,  and  patient  sensitivity  to  medications. 
"Basically,  the  system  will  tell  the  physician  what  the  preferred  drug  is  for  the  diag- 
nosis.    It  will  also  keep  the  patient's  drug  history  file  up  to  date  and  check  to  see  if 
the  patient  has  ever  had  a  reaction  to  the  drug  prescribed." 
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Citizen  Rights  Issues 

We  noted  earlier  two  basic  aspects  of  the  Los  Angeles  systems  that  frame  its 
treatment  of  citizen  rights  issues.    First,  most  are  poor,  members  of  racial  minority 
groups  (primarily  black  and  Chicane),  likely  to  be  dependent  on  welfare  and  other 
county  social  services,  and  often  of  low  or  little  literacy.    Second,  the  hospital  sys- 
tem is  understaffed  and  over-worked,  and  its  patients'  medical  problems  are  often  the 
result  of  urban  poverty  and  social  neglect  over  which  patients  and  hospital  staff  alike 
are  powerless.     The  situation  resembles  closely  what  the  documentary  filmmaJcer  Fred 
Wiseman  found  when  he  did  a  film  on  Metropolitan  Hospital  in  New  York  City.  Wiseman* 
went  expecting  "to  find  a  lot  of  bureaucratic  callousness  and  a  hardened  staff,  indif- 
ferent to  the  problems  of  the  poor.    What  I  generally  found,  though,  were  a  lot  of  doc- 
tors, nurses,  and  hospital  personnel  who  really  cared"  but  were  basically  unable  to 
overcome  the  "medical  consequences  of  bad  housing,  illiteracy,  no  jobs,  malnutrition, 
and  so  on."    When  issues  of  rights  such  as  privacy,  confidentiality,  and  patient  access 
to  records  arise,  the  problems  are  further  compounded  because  many  hospital  officials 
regard  these  as  "frills"  and  "expendable"  matters,  and  many  patients  in  a  place  like 
Los  Angeles  Medical  Center  simply  do  not  know  that  they  have  any  rights  at  all. 

Confidentiality 

As  in  other  hospitals ,  Medical  Center  personnel  begin  with  the  conviction  that 
a  patient's  medical  data  is"conf idential. "    But  exceptions  to  this  rule  come  in  legions. 
When  the  patient  is  admitted,  except  in  emergency  cases  where  the  patient  is  unable  to 
do  so,  all  patients  or  their  legal  guardians  must  sign  a  General  Consent  form  before 
treatment  begins.     The  patient  "agrees  to"  whatever  tests  and  medical  procedures  the 
hospital  staff  deems  necessary,  including  discharge  to  another  public  medical  institu- 
tion.      Since  this  is  a  teaching  facility,  the  form  also  specifies  the  patient's  con- 
sent to  "demonstration  and/or  observation"  by  physicians,  medical  students  and  student 
nurses.    Finally,  the  patient  also  formally  consents  to  "...release  of  medical  informa- 
tion to  other  institutions  or  agencies  accepting  the  patient  for  medical  or  institution- 
al care;  (and  to)  patient's  insurer."    A  copy  of  this  form,  which  is  in  English  and 
Spanish,  is  given  to  the  patient,  and  the  original  is  attached  to  the  patient's  chart. 

We  have  already  noted  some  of  the  ways  in  which  outside  non-medical  personnel 
obtain  access  to  patient  information  at  Los  Angeles  Medical  Center,  such  as  the  joint 
Commission  on  Hospital  Accreditation,  which  conducts  chart  review  for  accreditation 
purposes,  or  the  State  Department  of  Health,  which  also  conducts  chart  review  as  part 
of  its  yearly  inspection  routine.    Among  other  outside  non-medical  agencies  or  individ- 
uals who  share  patient  information  are  the  following: 

1 .  Insurance,  Medicare,  MediCal.  Each  month,  approximately  4,000  reports  go  to 
private  insurers ,  and  to  California  Blue  Cross  which  acts  as  intermediary  for  Medicare 
and  MediCal.     The  claims  form  includes  a  brief  "discharge  summary'^  -  dates  of  admission 
and  discharge,  diagnoses,  a  history  of  the  problem  and  a  list  of  surgical  procedures. 
Similar  information,  in  somewhat  greater  detail  goes  to  Blue  Cross  for  its  own  use. 


*"You  Start  Off  With  A  Bromide:  Conversation  with  Frederick  Wiseman,"  The  Civil  Liber- 
ties Review,  Binter/uprin^,  1974,  Vol.  1,  Ko,  2,  57. 
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The  claims  forms  are  prepared  from  the  patient's  record,  drawing  on  the  physician's 
formal  discharge  summary.     VJhere  no  discharge  summary  has  been  prepared  (the  large  back- 
log is  a  chronic  problem)  a  summary  is  constructed  from  recent  materials  in  the  record. 
The  general  consent  form  that  the  patient  signs  upon  admission  covers  the  release  of 
this  material.     In  addition,  most  patients  sign  a  release  as  a  condition  of  receiving 
state  or  federal  aid  or  private  insurance. 

2.  Employment,  security,  life  insurance,  disability,  investigations.     The  Medi- 
cal Records  Department  responds  to  about  18,000  ad  hoc  requests  a  year  for  information 
from  patient  records.     The  inquirer  generally  has  an  authorization  form  signed  by  the 
patient  as  part  of  his  application  for  insurance,  filing  a  disability  claim,  employment 
application,  etc.    An  average  of  about  one  request  a  month  is  turned  down,  generally  be- 
cause the  inquirer  did  not  have  the  proper  authorization. 

A  records  department  worker  describes  her  job  this  way:     "They  come  in  and  we 
make  them  sign  the  log  we  keep  of  all  the  people  who  look  at  records.     Then  we're  sup- 
posed to  check  the  patient  authorization  form.     If  it  is  more  than  six  months  old,  we 
refuse  the  request.    When  we  locate  the  record,  we  check  the  signature  on  the  form 
against  the  patient's  signature  in  the  record.     Then  we  either  type  out  a  summary  for 
them  or  let  them  sit  down  with  the  record."    The  hospital  will  copy  a  record  only  if  it 
has  been  subpoenaed,  but  lawyers  and  insurance  company  representatives  often  bring 
their  own  copying  equipment  to  the  Medical  Records  office,  and  are  generally  allowed  to 
use  it. 

Routine  claims- information  requests  concerning  psychiatric  treatment  are  handled 
like  other  medical  treatment  requests.  But  requests  from  lawyers,  or  from  insurance  or 
employment  investigators,  require  the  Assistant  Director  of  Psychiatry  to  authorize  the 
release  if  it  seeks  anything  more  than  dates  of  admission. 

"Most  of  the  requests  we  turn  down  are  in  the  mental  health  area,"  says  Medical 
Record  Director  Bliss.     "Let's  say  a  man  applies  for  a  job  and  he  was  treated  here  five 
years  ago  in  the  psychiatric  service.     The  Assistant  Director  might  refuse  to  release  a 
discharge  summary  if  he  feels  the  person's  problem  is  not  relevant  to  the  job  applied 
for.     The  job  applicant  may  have  signed  a  release,  but  the  law  allows  the  psychiatrist 
to  refuse  the  information  if  he  thinks  it  is  in  the  best  interests  of  the  patient  to 
do  so." 

This  may  create  a  dilemma:     "Sometimes  we  get  a  security  investigation  case,"  says 
Mental  Health  Services  Head  Clyde  Johnson,  "where  we  stand  to  hurt  the  patient  if  we 
release  the  information  on  file  —  because  it  might  be  misunderstood.     The  investigator 
can  assume  that  since  the  patient  has  signed  a  release,  but  we  have  refused  to  give  it, 
the  information  must  be  really  bad," 

3.  Public  Reporting  Requirements:    Physicians  are  required  under  California  law 
to  report  injuries  they  think  were  the  result  of  a  criminal  act,  either  self-inflicted 
or  from  violence  by  another  person.    Assistance  Medical  Records  Director  Faulkner 
states  that  "Where  it  is  the  physician  (rather  than  the  police)  who  discovers  a  knife 
wound,  say,  or  a  battered  child,  he  just  notifies  Security  and  they  notify  the  Los 
Angeles  Police." 

Communicable  diseases,  such  as  V.D.,  and  drug  overdose  cases,  must  be  reported 
to  the  Department  of  Health  on  standardized  forms.     In  the  case  of  V.D. ,  although  the 
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Health  Department  follows  elaborate  procedures  for  protecting  the  confidentiality  of 
those  on  whom  they  follow  up,  there  is  widespread  resentment  by  Los  Angeles  County  pa- 
tients against  the  mandatory  reporting,  since  it  is  widely  believed  that  the  private 
physicians  who  treat  the  more  affluent  protect  their  patients  by  ignoring  the  reporting 
provisions  of  the  law. 

4.  Law  Enforcement;    FBI  and  Immigration  investigators  occasionally  check  medi- 
cal records.    Records  workers  report  that:     "They  show  their  identification  and  sign 
the  log.    Usually  they  are  just  checking  out  someone's  story.     They  want  to  know  the 
dates  we  treated  the  person,  what  the  ailment  was,  that  sort  of  thing." 

For  the  last  four  years,  the  Los  Angeles  Police  Department  has  had  a  liaison 
officer  working  in  the  hospital  records  office.     "Before  this  time,"  Bliss  recalls, 
"all  divisions  of  LAPD  were  coming  in  here  from  everywhere  and  it  got  pretty  hard  to 
keep  track  of.     So  when  LAPD  suggested  filtering  all  requests  through  an  officer  per- 
manently stationed  here,  it  solved  a  lot  of  problems.      The  officer  interviews  patients 
who  are  victims  of  crime  -  with  their  permission  -  and  interrogates  prisoners  in  the 
jail  ward.     He  handles  information  requests  from  LAPD  officers,  most  of  them  over  the 
phone."    A  Sergeajat  on  duty  said,  "Sometimes  we  need  to  locate  a  victim  who  has  already 
been  released.     We  can  check  to  see  what  address  he  or  she  was  discharged  to.    We  also 
get  missing  persons  cases... We  can  check  the  daily  admissions  report  for  a  psychiatric 
admission,  maybe.     Then  we  call  the  ward  to  check  the  identification  further.    What  ad- 
ditional information  we  get  depends  on  ward  personnel.     I  don't  actually  let  anyone 
handle  the  record.    Even  if  another  officer  did  come  in,  he  couldn't  just  sit  and 
browse.    Where  mental  health  is  involved,  I  can  look  at  the  record,  but  I  couldn't  use 
anything  from  it  except  for  locating  a  person.     Sometimes  we  can  pull  good  identifying 
information  like  Social  Security  number  or  Military  I.D." 

Patient  authorization  for  release  of  information  is  not  required  by  law  or  by 
the  hospital  for  public  reporting  requirements  or  for  inspection  by  law  enforcement 
officers. 

5.  Civil  Suits;    Once  a  patient  has  filed  a  disability  suit,  a  malpractice  suit, 
or  a  suit  for  damages  resulting  from  an  accident,  his  medical  file  may  be  open  not  only 
to  his  own  lawyers  but  to  the  opposing  party  as  well.    When  the  patient's  record  is  sub- 
poanaed,  the  whole  record  is  usually  copied  and  sent  to  the  clerk  of  the  court:  there 

it  is  kept  "closed"  until  the  judge  determines  that  it  is  relevant  to  the  case.    It  is, 
however,  put  into  the  file  of  the  case,  and  that  is  open  for  anyone  involved  with  the 
case  to  see. 

A  lawyer  in  the  Public  Defender's  Office  comments  that  "Should  you  need  medical 
information  to  help  you  impeach  a  witness ,  you  may  be  able  to  get  good  leads  from  the 
patient's  physician.    He  may  be  reluctant  to  talk  about  the  case,  but  most  physicians 
dislike  taking  a  day  off  to  go  to  court  and  testify.     So  you  can  threaten  to  subpoena 
him,  and  he'll  tell  you  enough  to  get  you  started." 

6.  Public  Inquiries;     Those  who  enquire  about  a  patient  at  the  hospital  are 
given  only  a  brief  "condition  report",  in  addition  to  the  fact  that  the  person  is  a 
patient  at  the  facility.    Hospital  rules  forbid  staff  members  to  release  more  informa- 
tion about  a  patient.    According  to  Bliss,  "Very  few  public  figures  come  here,  so  we 
don't  often  have  a  problem  of  keeping  reporters  away."    The  hospital  does  treat  pa- 
tients who  have  been  involved  with  the  police,  however,    a  50-bed  jail  ward  is  part  of 
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General  Hospital.     "These  patients  are  in  the  custody  of  the  Sheriff's  Office,"  said 
Bliss,  "so  we  turn  enquiries  over  to  them.    At  one  time  we  had  the  brother  of  Sirhan 
Sirhan  here.     There  were  many  inquiries  about  his  specific  condition,  ajid  he  was  in  the 
psychiatric  unit  so  the  matter  was  even  more  sensitive.    We  just  left  it  up  to  the 
Sheriff  what  he  wanted  to  release." 

After  the  patient  leaves  the  Medical  Center,  his  or  her  record  is  sent  to  the 
Medical  Records  Room  at  General  Hospital,  where  it  will  be  stored  for  approximately 
five  years.    After  this  time,  records  are  sent  for  ten  years  into  permanent  warehouse 
storage  in  the  County  Archives. 

Confidentiality  of  Patient  Records  Within  the  Hospital 

The  preceeding  discussion  described  the  broad  dissemination  of  patient  informa- 
tion that  is  made  to  outside,  non-medical  agencies,  either  without  the  patient's  knowl- 
edge and  consent,  or  with  a  pro  forma  consent  to  which  the  patient  must  agree  in  order 
to  receive  medical  treatment.    Part  of  this  pattern  stems,  as  previously  noted,  from 
the  lack  of  financial  resources  which  compels  the  hospital  to  focus  on  the  patient's 
financial  eligibility.    Part  of  it  stems  from  the  perception  of  the  patient  by  the 
staff  as  a  passive  recipient  of  medical  treatment  -  a  person  unable  to  understand  the 
treatment,  unable  to  contribute  his  own  reactions,  uninterested  in  his  own  record,  and 
therefore  unconcerned  about  its  confidentiality.    These  staff  perceptions  also  dictate 
the  way  in  which  medical  records  are  shared  within  the  hospital. 

Members  of  the  nursing  staff  believe  that  patients  are  not  good  sources  of  in- 
formation about  their  own  medical  problems.     Sometimes  there  is  a  language  barrier. 
But  even  where  there  isn't,  the  patient  may  have  been  told  so  little  about  his  condi- 
tion during  past  visits  that  he  cannot  offer  reliable  information.     "Half  the  time  our 
patients  don't  even  know  why  they  are  here,"  said  one  nurse.     "They  are  often  very  con- 
fused and  upset  by  the  whole  experience.    Only  rarely  are  they  concerned  about  what  you 
are  writing  down  in  the  records." 

The  practice  of  collecting  a  broad  range  of  financial  Information  for  eligibil- 
ity, the  searching  interviews  with  the  Financial  Service  workers,  and  the  storing  of 
the  patient's  chart  in  an  accessible  place  at  the  ward  nursing  station  are  not  seen  by 
the  staff  as  creating  patient  resentment  over  violations  of  confidentiality. 

Patient  data  in  the  Admissions  system  are  available  in  nine  hospitals  via  al- 
most 120  terminals.    Health  Informations  System  Chief  Gene  Thompson  believes  that  secu- 
rity of  this  material  comes  from  the  fact  that  "most  people  don't  know  what  data  is  in 
the  system... We  could  have  sensitive  psychiatric  data  in  there  and  most  terminal  users 
wouldn't  know  how  to  get  it  out  if  they  were  asked."    3.000  cardiac  histories  are  given 
extra  protection  by  limiting  their  dissemination  to  the  two  terminals  in  the  EKG  unit. 
Thompson  adds  that  early  in  the  development  of  computer  applications  for  County  hospi- 
tals, the  decision  was  made  that  control  over  release  of  information  and  responsibility 
for  its  protection  would  remain  in  the  hands  of  the  Medical  Records  Department,  the 
same  unit  which  controls  release  of  the  manual  records  described  above. 

Medical  Records  Director  Bliss  states  that  if  you  "really  wanted  data  out  of 
that  (computer)  system  and  you  could  convince  a  clerk  to  do  it,  there's  nothing  to 
stop  that.     There's  no  such  thing  as  a  perfect  system." 
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Neither  Medical  Services  Administrator  Dr.  Sol  Bernstein  nor  his  counterpart  on 
the  administrative  side,  John  McClurg,  could  remember  many  complaints  involving  confi- 
dentiality of  the  hospital's  records.    Bernstein  said,  "I  do  remember  one  case  where  a 
person  wrote  in  to  complain.     She  had  transsexual  surgery  performed  and  at  some  later 
time  had  seen  a  copy  of  her  medical  record.     In  it,  she  found  herself  described  as  "he" 
in  quotation  marks.     She  found  this  offensive  and  wanted  the  slurs  removed." 

Bernstein  went  on  to  observe:  "Most  of  our  patients  are  not  as  sophisticated  as 
patients  in  private  hospitals,  so  they  don't  raise  complaints  often.     In  a  training  in- 
stitution like  this — particularly  a  public  one — the  record  is  a  veiy  open  one.  We'd 
like  it  to  be  otherwise.    Even  our  staff  members  raise  the  issue.    A  short  time  ago, 
interns  and  student  nurses  raised  the  issue  with  respect  to  their  own  medical  records." 
Some  of  them  receive  treatment  at  county  medical  or  psychiatric  facilities,  including 
the  Medical  Center,  and  they  worry  about  who  among  their  colleagues  might  gain  easy, 
albeit  unauthorized,  access  to  the  records. 

Local  American  Civil  Liberties  Union  chapters  and  political  groups  in  Los 
Angeles  report  few  complaints  on  confidentiality  issues  in  medical  records.  Speaking 
generally  about  the  problems  which  low  income  patients  face  in  California,  Kenneth  Wing 
of  the  National  Health  Law  Center  at  UCLA  said  "The  right  to  keep  your  medical  records 
confidential  is  an  obscure  legal  right,  almost  totally  unenforceable.     The  institution 
knows  that  the  patient  won't  sue  because  of  it.    Also,  it's  a  luxury  issue  that  no 
legal-services  agency  will  handle  when  legal  resources  are  limited."    He  did  report 
that  "some  cases  involving  confidentiality  have  come  here.     For  example,  one  patient 
felt  that  there  were  inaccuracies  in  her  psychiatric  record.     She  couldn't  get  to  the 
records,  which  were  in  a  state  facility.    And  G-od  knows  who  had  access  to  the  informa- 
tion.    She  thought  there  was  mis-diagnosis  about  ten  years  ago  and  it  came  up  in  some 
employment  process.    But  we  said,  given  our  limited  resources,  we  couldn't  pursue 
this . " 

Patient  Access 

Under  California  law,  the  patient  has  no  guaranteed  right  to  see  his  or  her  medi- 
cal record  personally.    However,  the  patient  can  authoi-ize  an  attorney  to  see  the  re- 
cord, sind  some  hospitals  have  extended  this  to  include  showing  patients  their  record 
whenever  they  say  they  are  contemplating  litigation.     Los  Angeles  County  does  not  do 
this.    As  to  malpractice,  doctors  are  adjured  to  take  pains  to  get  the  necessary  con- 
sent forms  for  surgical  and  other  procedures  (which  presumably  are  not  covered  by  the 
general  consent  form  signed  by  the  patient  upon  admission)  and  in  getting  such  "in  - 
formed  consent"  the  patient  must  be  told  something  about  the  upcoming  surgery.  Of 
course,  getting  informed  consent  here  is  for  the  protection  of  the  doctor,  not  for  the 
information  of  the  patient. 

In  the  normal  course  of  a  hospital  stay,  the  patient  is  told  little  about  his 
record.     The  following  staff  comments  speak  for  themselves:  A  nursing  supervisor: 
"Sometimes  the  patient  wants  to  see  the  chart  when  they've  been  kept  virtually  incom- 
municado for  some  time.     The  patient  may  want  to  know  how  the  X-rays  came  out  because 
nobody  told  him.    Or  the  patient  may  just  want  to  know  what's  happening  to  him  and 
what's  going  to  be  done." 
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The  Nursing  Services  Administrator:  "If  they've  had  an  argument  with  their  doc- 
tor, or  they've  gotten  upset  and  thrown  something  at  a  nurse,  they  want  to  see  what's 
been  written  about  them.     They  don't  want  to  be  written  up  as  a  troublemaJcer.  Some- 
times it's  more  of  a  medical  matter  that  they  want  to  control,  like  whether  the  doc- 
tor describes  their  problems  as  "alcohol  related." 

Because  patients  are  billed  at  a  flat  daily  rate,  and  the  bills  are  not  item- 
ized, patients  sometimes  go  to  the  Medical  Records  Department  for  an  explanation. 
Assistant  Medical  Records  Director  Faulkner  says  that  occasionally  the  Records  staff 
will  sit  down  with  a  patient  and  go  over  the  things  that  the  bill  covers  "if  we  think 
it  will  help." 

The  staff  does  not  recall  ever  having  been  sued  over  a  patient  access  issue, 
and  receives  very  few  complaints  about  it.    Dr.  Bernstein  comments:  "As  a  matter  of 
hospital  policy,  the  patient  ought  to  know  as  much  as  possible  about  his  condition. 
The  patient  moves  from  place  to  place  for  care,  and  his  records  don't  always  catch  up 
with  him.     But  it's  hard  to  keep  a  patient  informed  in  a  public  hospital  setting  like 
ours.    And  I'm  not  sure  that  just  giving  the  patient  his  record  is  the  answer." 

Informed  Consent 

The  issue  of  informed  consent  was  raised  quite  sharply  in  1 974  when  a  group  of 
Chicano  and  Black  women  sued  the  Medical  Center,  claiming  that  they  had  been  sterilized 
without  knowledgeable  consent.    One  of  the  women  noted  that  she  had  worn  an  lUD  device 
for  two  years,  not  realizing  that  she  had  been  sterilized  in  the  course  of  a  caesarian 
delivery.     The  women  sought  damages,  and  asked  the  court  to  force  the  hospital  into 
compliance  with  new  HEW  regulations  on  consents  for  sterilization. 

Under  court  and  community  pressure,  the  hospital  has  increased  its  efforts  to 
comply  with  HEW  rules.    A  new  consent  form,  in  Spanish  as  well  as  English,  was  adopted 
which  explains  the  procedures  and  their  consequences  in  language  at  the  6th  grade  level. 
In  addition,  a  72  hour  waiting  period  is  observed,  where  possible,  between  consent  and 
the  operation.     Civil  liberties  lawyers  who  work  on  such  problems  (including  the  law- 
yers for  this  case)  generally  agree  that  the  HEW  regulations  are  adequate.     The  pro- 
blem, they  say,  is  that  most  hospitals  operate  in  such  a  way  that  it  is  very  difficult 
to  enforce  them.    Bliss  noted  that  the  suit  has  had  the  effect  of  making  the  hospital 
staff  more  cautious  in  sterilization  cases.     "There's  more  staff  consultation  and  we've 
tried  to  increase  supervision  and  counselling  so  that  no  one  signs  a  consent  when  they 
are  not  in  a  position  to  think  about  it  clearly."    Recently,  there  has  been  some  dis- 
cussion of  preparing  a  consent  form  in  still  simpler  language — perhaps  at  the  3rd  grade 
level. 

Observations 

Los  Angeles  County's  Medical  Center  shows  what  happens  to  citizen  rights  when 
computerization  unfolds  in  a  setting  of  medical  efforts  to  provide  acute  care  under 
ghetto  conditions.     The  pressure  to  recover  costs  from  as  majiy  people  as  possible  is 
the  underlying  reason  for  demanding  extensive  disclosure  from  patients,  and  this  forced 
computer  efforts  toward  fiscal  applications  rather  than  the  emphasis  on  patient  care 
that  the  data  bank  project  originally  hoped  to  maintain.    Providing  patient  dignity  — 
of  which  rights  of  privacy,  informed  consent,  confidentiality,  and  individual  access 
are  prime  components  —  is  a  casualty  to  the  rush  of  hospital  personnel  to  handle  the 
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daily  pressures  —  drug  overdoses,  acute  alcoholism,  baby  batterings,  lead  poisoning, 
and  all  the  other  medical  stigmata  of  life  in  East  Lost  Angeles. 

Of  course,  there  are  difficult  issues  here;  the  civil  liberties  values  do  have 
to  be  weighed  against  needs  of  law  enforcement,  monitoring  health  care  eligibilities, 
protecting  public  health,  etc.    But  at  Los  Angeles  County  Medical  Center  today,  there 
is  so  little  balance  at  work;  no-one  within  the  Center  staff  or  outside  groups  are 
there  to  put  the  civil  liberties  values  into  the  other  scale,  and  call  for  sensitive 
judgments  to  be  made. 

If  American  society  were  to  decide  that  rights  of  informed  consent,  confiden- 
tiality and  patient  access  were  to  be  defined  and  protected,  making  these  meaningful 
at  urban  hospitals  such  as  Los  Angeles  County  would  require  both  financial  and  person- 
nel resources.    New  consent  and  confidentiality  rules  and  procedures  would  have  to  be 
posted  and  explained,  and  their  observance  policed  by  patients'  rights  advocates  or 
ombudsmen.  Enlarging  patient  access  would  take  a  major  recasting  of  medical-record  no- 
tations into  language  intelligible  to  the  lay  person,  a  process  strongly  advocated  by 
"consumer  oriented"  medical  experts  such  as  Dr.  Lawrence  Weed,  who  see  such  disclosure 
as  a  vital  part  of  patient  participation  in  the  health-seeking  process.     Staff  time 
would  also  have  to  be  provided  to  hold  conferences  with  Los  Angeles'  patients  to  ex- 
plain the  record,  and  to  answer  questions.     This  type  of  patient-hospital  relationship 
has  thus  far  been  limited  to  a  few  elite  institutions,  usually  with  middle  and  upper 
class  patients,  and  even  fewer  community  health  centers  treating  the  poor. 

Some  progress  toward  such  practices  may  well  be  mandated  by  law.    A  bill  to  cre- 
ate a  California  Fair  Information  Practices  Act,  introduced  in  1974,  would  regulate  the 
use  and  transfer  of  all  personal  data  in  the  personal  data  systems  of  government  agen- 
cies, whether  state,  county,  or  municipal.     This  would  include  medical  records,  and 
would  strengthen  both  confidentiality  rules  and  patient  access  rights  in  public  insti- 
tutions.    The  bill  was  passed  in  1975  but  was  vetoed  at  the  last  minute  by  Governor 
Edmund  Brown,  Jr. ,  in  part  because  of  the  expense  he  said  it  would  cost  government 
agencies  to  comply.     The  bill  was  reintroduced  in  1976  and  has  excellent  chances  of  re- 
passage.    Five  states  —  Massachusetts,  Arizona,  Minnesota,  Utah,  and  New  Hampshire  — 
have  already  passed  such  acts  in  the  past  2  years. 

The  effects  of  such  new  laws  in  urban  hospitals  have  yet  to  be  felt.     It  may  be 
some  time  before  regulations  implementing  them  are  issued  and  followed,  and  before  pa- 
tients begin  to  learn  what  rights  they  have  and  to  exercise  them.    But  the  seeds  of 
change  are  in  such  new  laws,  and  their  effects  at  institutions  like  the  Los  Angeles 
County  Hospital  System  may  well  be  enormous  in  the  coming  years. 
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CHAPTER  6.  MRTIN  LUTHER  KING  JR.  HEALTH  CENTER 


The  Dr.  Martin  Luther  King  Jr.  Health  Center  is  a  federally- funded,  private 
facility  providing  ambulatory  care  in  a  poverty  area  of  the  South  Bronx  (New  York  City). 
Associated  with  Montefiore  Hospital,  it  supplies  comprehensive,  continuous,  and  family- 
centered  health  care  to  approximately  40,000  registered  patients,  out  of  an  area  popu- 
lation of  90,000.     A  staff  of  450  offers  in-patient  medical  services,  preventive  care 
activities,  chronic  disease  treatment,  and  a  wide  range  of  socio-medical  programs. 

The  Center  is  as  much  a  social  insitution  as  a  medical  facility,  and  has  been 
described  by  observers  and  residents  alike  as  the  most  active,  important,  and  communi- 
ty-accepted organization  in  the  area.    Patients'  rights  are  a  foremost  concern  —  as 
a  matter  of  Center  philosophy,  rules,  training,  and  daily  procedures.    Furthermore,  the 
adoption  of  computer  technology  at  the  Center  has  been  carried  out  in  the  context  of 
very  different  goals  and  management  "styles"  than  in  Los  Angeles:  a  stress  on  the 
health-team  rather  than  medical-professional  model  of  care;  major  community  inputs 
into  Center  priorities  and  decisions;  and  an  insistence  that  "machines"  must  facili- 
tate rather  than  weaken  the  Center's  basic  commitment  to  patient  dignity  and  social 
advocacy. 

Background 

The  formation  of  the  King  Center  came  from  two  interconnected  developments  in 
the  middle  1960's:  (1)  the  interest  of  the  federal  Office  of  Economic  Opportunity  (OEO) 
in  funding  demonstration  projects  for  comprehensive  health  care  in  low-income  neighbor- 
hoods, and  (2)  the  desire  of  Dr.  George  Silver,  Chief  of  Social  Medicine  at  Montefiore 
Hospital,  to  develop  an  out-patient  group  practice  for  the  area's  overcrowded  hospital 
clinics  and  emergency  room  facilities.     Silver  was  also  influenced  by  a  consumer- 
controlled  clinic  in  Saskatchewan,  Canada,  and  he  saw  some  form  of  local-community 
participation  as  an  important  ingredient  in  his  plan. 

The  area  in  which  the  King  Center  emerged  was  (and  still  is)  an  urban  disaster 
zone.    A  45-block  section  of  the  South  Bronx,  it  was  once  a  lower  middle  class  Jewish 
community.     But  by  the  1960's,  it  had  become  a  poverty  area  with  45/^  Afro-Americans, 
AT/o  Latin- Americans ,  and  6%  whites.     Its  statistical  characteristics  represent  a  litany 
of  social  blight:  ^Ofo  unemplo5Tnent ;  highest  arson  rates  in  the  nation;  ZOfo  of  the 
buildings  abandoned;  one  of  the  highest  narcotics  death  rates  in  the  city;  high  inci- 
dence of  tuberculosis,  VD,  alcoholism  and  lead  poisoning;  widespread  rat  and  vermin 
infestation;  and  substandard  schools,  police,  sanitation,  transportation,  and  welfare 
services.     There  are  four  public  housing  developments  in  the  area;  while  their  physi- 
cal layout  is  less  dismal  than  the  surrounding  blocks,  local  community  leaders  call 
them  "a  high-rise,  concrete  ghetto,"  and  these  residents  face  a  serious  crime  problem 
daily. 

The  Center  opened  in  1967,  funded  by  a  SI .9  million  grant  from  OEO  given  to 
Montefiore  Hospital,  as  the  Center's  sponsoring  organization.     In  its  first  year,  it 
supplied  care  to  1,400  registered  families.    OEO's  guidelines  for  the  Center  were  cast 
in  the  war-on-poverty  framework  of  that  period:     "a  commitment  to  the  concept  of  re- 
distributing power  within  a  community  setting   
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....and  a  restoration  of  the  citizen's  significance  within  a  community."     The  Center 
spent  six  years  under  OEO  aegis,  expanding  its  services  steadily.      This  ended  in  1973, 
and  the  Center's  federal  support  (now  about  half  of  an  annual  budget  slightly  over 
$8  million)  has  come  since  then  from  a  grant  by  the  Bureau  of  Community  Health  Services, 
in  the  Health  Services  Administration  of  HEW.     The  other  half  of  the  Center's  budget 
comes  from  Medicaid  and  other  third- party  payers.     In  1972,  the  Center  had  over  200,000 
patient  visits,  and  its  Family  Health  Workers  made  over  40,000  home  visits. 

The  Center's  concept  of  medical  care  and  social  advocacy  rests  on  five 
approaches : 

1 .  Reaching  Out  into  the  Community 

The  Center's  philosophy  is  based  on  the  concept  of  community  outreach.     It  does 
not  wait  for  a  patient  to  come  to  it  with  particular  ailments,  then  treat  just  those. 
Rather,  its  goal  is  to  practice  preventive  medicine  by  registering  families  and  treat- 
ing them  on  a  continuing  basis,  starting  with  a  general  check-up.     Beyond  that,  it 
seeks  to  identify  serious  community  health  problems,  and  attack  them  in  a  unified  way 
through  individual  care,  research,  education,  and  social  action. 

Of  the  90,000  people  in  the  Center's  current  geographical  area,  39,000  in  ap- 
proximately 9,400  families  are  registered  as  patients.     This  was  originally  achieved 
by  the  stuffing  of  mailboxes  with  leaflets  about  the  Center  and  attending  community 
meetings.    Because  the  community  has  a  high  population  turnover,  continuing  registra- 
tion campaigns  are  needed. 

Non- registered  patients  do  not  get  total  team  care,  but  they  are  given  emergency 
care  and  occasionally  specialized  care.    As  registration  of  families  increases,  emer- 
gency room  use  decreases.     It  presently  stands  at  about  25/^  of  patient  visits,  down 
from  between  35-40%  during  the  Center's  first  year. 

The  hope  of  the  Center's  founders  was  that  every  individual  regardless  of  in- 
come would  be  eligible  for  care  at  the  Center.     But  in  1971 ,  simultaneously  with  a  re- 
duction in  the  amount  of  the  OEO  grant,  OEO  issued  a  regulation  requiring  a  means  test 
and  setting  a  fee  schedule  for  those  ineligible  for  government  aid.     The  ruling  brought 
an  angry  reaction  from  MLK's  then  Director,  Dr.  William  Lloyd. 

"The  pain  to  be  inflicted  on  our  patients  is  of  far  greater  magnitude  than 
the  blow  to  the  Center's  goal  of  serving  the  community  with  comprehensive  care.  The 
retired  civil  servant  with  heart  disease  cannot  afford  good  ambulatory  care  here  or 
elsewhere ...  The  children    of  a  marginally  employed  worker  will  no  longer  be  screened 
for  lead  poisoning. . .We  believe  that  the  best  guarantee  that  a  single  standard  of 
health  care  applies  to  all  is  to  treat  all,  without  economic  distinction,  in  the  same 
program." 

As  a  result  of  the  ruling,  the  Center  was  forced  to  limit  registration  to: 
1)  care  of  pregnant  women  and  new  mothers  and  babies;  2)  patients  eligible  for  Medi- 
caid; 3)  patients  eligible  for  Medicare;  and  4)  shut-ins.    Since  809^  of  the  community 
is  poor  enough  to  be  eligible  for  Medicaid  or  Medicare ,  this  meant  that  about  20%  of 
the  people  were  -  and  are  -  cut  off  from  registered  care.     In  addition,  the  registra- 
tion forms  had  to  be  changed  to  include  questions  about  "income"  and  "welfare  status" 
which  had  not  been  asked  before. 

2.  Community  Programs 

The  Center  believes  that  pursuing  good  health  requires  both  patient  education 
and  social  action    alongside  patients  where  conditions  in  the  community  threaten 
health. 

Among  the  Center's  special  programs  have  been: 
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a)  Lead  Poisoning  Prevention.     The  Center  tested  registered  children  from  ages 
1-6  who  appeared  to  have  one  or  more  "suspicious"  lead  poisoning  symptoms.     It  pin- 
pointed those  apartment  houses  with  peeling  paint  or  plaster,  and  held  meetings  with 
parents  to  explain  the  dangers  and  suggest  prevention,  and  put  families  in  touch  with 
New  York's  Emergency  Repair  Services. 

h)  Drug  Ahuse  and  Alcoholism.     The  Center  identifies  addicts  through  check-ups 
and  through  home  visits  by  the  family  health  workers.     They  are  referred  to  various 
city  drug  programs  and  hospitals  for  detoxification.     In  addition,  the  Center  set  up 
a  store-front^ walk- in  center  where  residents  may  get  educational  materials  on  drugs, 
referrals  and  counselling.    A  similar  project  in  cooperation  with  community  groups 
was  undertaken  for  alcoholics. 

c)  School  Health  Education  Projects.    Four  teams  of  three  staff  members  con- 
ducted 45-niinute  daily  health  sessions  with  the  1 5  eighth  grade  classes  of  Intermedi- 
ate School  #148.     The  sessions  covered  sex  education,  menstruation,  human  growth, 
nutrition,  venereal  disease,  dental  care,  narcotics,  alcoholism,  family  relations  and 
any  other  questions  on  the  students'  minds. 

d)  Environment.  "Providing  comprehensive  medical  care  to  some  39,000  people 
living  in  a  low  income  area  of  the  South  Bronx... is  simply  a  half  measure  since  local 
environmental  conditions  are  the  source  of  many  of  the  area's  medical  problems."  This 
reasoning  led  the  Center  into  active  participation  with  other  groups  to  improve  hous- 
ing and  environment  through  seeking  housing  planning  grants  from  the  federal  govern- 
ment; negotiating  with  landlords  for  building  maintenance,  trash  removal  and  rat  con- 
trol; negotiating  with  city  officials  to  insure  housing  law  enforcement;  and  finding 
private  and  public  sponsors  for  new  housing. 

e)  Recreation.     The  .Center  has  sponsored  a  youth  club  as  an  alternative  to 
street  gangs',    this  gave  instruction  and  help  in  community  projects,  black  and  Puerto 
Rican  culture,  arts  and  crafts,  health  education,  and  career  development.     It  sponsored 
a  summer  recreation  program  in  which  125  teen-agers  participated. 

These  community  programs,  and  the  training  programs,  have  had  to  be  cut  back 
or  eliminated  because  of  cuts  in  federal  funding  in  the  1971-76  period,  but  the  Center 
continues  to  pursue  them  as  vigorously  as  funds  allow. 

3.  Recruitment  of  Staff  from  the  Community,  and  of  "Committed"  Medical  Personnel 

To  recruit  its  general  staff,  the  Center  stuffed  local  mailboxes  with  fliers 
urging  applications  from  residents  and  held  more  than  1 50  meetings  with  community  organ- 
izations in  churches,  schools  and  apartment  houses  to  explain  the  Center  and  urge  peo- 
ple to  work  there.     The  majority  of  the  450-member  staff,  as  a  result,  resides  in  the 
community  and  is  905^  black  or  Puerto  Rican,  closely  approaching  the  community's  compo- 
sition, now  62fo  black  and  J)6fo  Puerto  Rican. 

The  recruitment  of  doctors  to  reflect  the  community's  racial  composition  has 
not  been  as  successful.    Of  the  Center's  98  full  and  part-time  doctors,  only  9  are 
black  or  Puerto  Rican  in  spite  of  the  Center's  vigorous  attempts  to  enlist  them;  how- 
ever, many  other  foreign  nationals  serve  on  the  medical  staff;  these  include  Indians, 
Pakestanis,  and  other  non-whites.        The  turnover  of  doctors  has  been  high,  with  an 
average  service  of  three  years  or  less.     The  original  vision  of  the  Center's  founders 
was  a  cadre  of  permanent  doctors  dedicated  to  the  family-oriented,  team  practice  of 
medicine,  who  would  provide  continuity  and  confidence  to  the  patients.     That  goal 


seemed  practical  daring  the  1960's  when  many  students  chose  public  service  over 
professional  advancement  -  teachers  choosing  ghetto  schools,  lawyers  spurning  corpo- 
rate practice  for  pro  bono  firms,  doctors  regarding  assignment  to  ghetto  health  care 
as  an  opportunity,  not  as  consignment  to  "Siberia."     Today,  though,  the  Center  has  a 
predominantly  short-term,  white  medical  staff. 

4.  Special  Training  in  Center  Philosophy  ajid  Techniques 

The  Center  conducts  training  for  its  staff  to  insure  promotion  from  within 
wherever  possible.    At  present,  26  of  its  29  supervisors  are  community  residents,  many 
of  whom  were  previously  unemployed  and  inexperienced;  five  of  its  eight  senior  managers 
are  community  residents.    Perhaps  the  most  remarkable  success  story  is  that  of  Ms. 
Deloris  Smith.    Although  she  had  no  professional  training,,  Ms.  Smith  had  long  been  a 
leader  in  community  affairs  — in  the  PTA,  in  organizing  a  jredit  Union,  as  an  officer 
of  the  Tenants'  Association.     She  enlisted  as  a  Family  Health  Worker  trainee  at  one  of 
the  Center's  community  recruitment  meetings  in  1967  because  "it  was  November. • .and  they 
were  paying  $55  a  week  to  trainees  so  I  figured  that  by  the  time  Christmas  came  around 
I  would  have  $250  saved  and  I  could  use  the  money  to  buy  presents  for  my  seven  kids." 
Ms.  Smith  rose  to  become  Deputy  Director  and  is  now  Director  of  the  Center,  the  first 
non-M.D.  to  hold  that  post. 

During  its  first  five  years,  the  Center  also  conducted  training  for  community 
residents  so  that  they  could  get  jobs  elsewhere.     Its  training  program  now  is  much 
smaller   than  it  was  in  1967-1972,  during  which  time  it  turned  out  some  400  medical 
assistants,  technicians,  family  health  workers,  and  medical  clerical  workers.  The 
shrinking  job  marke    fxnd  the  cut  in  the  Center's  budget  have  forced  it  to  confine  its 
training  to  those  special  Center  projects  where  specific  job  skills  are  required. 

5.  The  Community  Advisory  Board 

As  with  most  OEO  programs,  one  of  the  requirements  for  the  Center  was  the  crea- 
tion of  a  Board  that  would  represent  the  community.     This  was  also  the  goal  of  the  Cen- 
ter's founders  — to  have  a  Board  not  of  wealthy  or  socially  prominant  patrons  but  of 
people  from  the  same  social  class  as  the  patients.     The  Center's  Board  is  elected  by 
21  delegates,  who  become  delegates  by  collecting  25  supporting  signatures  on  a  neigh- 
borhood petition.     The  21  delegates  elect  the  21  members  of  the  Board,  and  are  them- 
selves eligible  to  run  for  the  Board.     Thus  the  delegates  and/or  Board  members,  while 
fulfilling  the  community-resident  requirements,  represent  an  electorate  of  less  than 
600  individuals  in  a  population  of  approximately  60,000  voting  age  adults. 

It  is  difficult  to  assess  the  part  actually  played  by  the  Community  Advisory 
Board  in  setting  Center  policies  or  in  providing  a  community  link,  partly  because 
there  is  not  a  common  understanding  of  the  Board's  role.     The  Center's  staff  and  the 
union  representing      the  staff  have  feared  Board  intervention  into  management  deci- 
sions, and  there  have  been  some  confrontations  over  hiring  and  firing.     The  Community 
Board,  on  its  side,  has  objected  to  being  by-passed  in  the  establishment  of  community 
programs . 

Under  the  original  OEO-Center  agreement,  the  Community  Board  was  meant  to  be  the 
recipient  of  the  federal  grant  by  1973,  replacing  the  sponsoring  Montefiore  Hospital. 
When  HEW  replaced  OEO  as  the  grantor  in  1973,  the  transfer  of  the  grant  to  the  Commu- 
nity Board  was  delayed  indefinitely,  and  for  this  the  Community  Board  blames  not  only 
OEO  and  HEW,  but  the  Center's  administration. 
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In  spite  of  a  history  of  conflict,  the  Center  and  the  Board  have  found  a  basic 
modus  Vivendi.    One  can  infer  that  the  Center  regards  the  Board  as  an  important  commu- 
nity link,  although  not  the  only  one.     The  Board,  although  frustrated  in  its  desire 
to  get  the  grant  funds  and  set  policy,  recognizes  that  the  administration,  as  a  Board 
spokesman  said,  is  trying  to  deliver  "the  best  services  possible  in  the  Health  Center." 

Health  Care  At  The  Martin  Luther  King  Center 

The  community  ties  developed  by  the  Center  serve  to  break  down  the  "we-they" 
attitudes  that  have  in  the  past  characterized  many  programs  for  the  poor.      When  staff, 
hired  from  the  community,  work  with  community  residents  to  secure  better  housing,  for 
instance,  a  spirit  of  partnership  instead  of  paternalism  is  fostered.     That  same  spirit 
of  partnership  permeates  the  Center's  practice  of  medicine. 
1 .  Team  Practice 

Each  registered  family  is  assigned  to  one  of  eight  health  care  teams.    A  typical 
health  care  team  consists  of  six  family  health  workers,  two  public  health  nurses,  one 
pediatrician,  two  internists,  one  dentist  and  one  secretary.    A  pharmacist  serves  two 
to  three  health  teams. 

The  family  health  worker  (both  men  and  women  serve  in  these  posts)  provides  the 
closest  link  to  the  patients.    After  six  months'  training,  these  workers  are  able  to 
keep  records,  perform  certain  medical  duties,  make  referrals  to  other  agencies,  explain 
the  Center's  operations,  assist  with  appointments,  and  generally  help  with  the  family's 
medical  and  social  problems.    Each  family  health  worker  serves  about  225  families  and 
tries  to  visit  each  one  at  least  once  every  three  months  as  well  as  to  register  eligi- 
ble new  families  as  they  move  into  the  neighborhood. 

A  family  health  worker  describes  some  of  the  things  she  does  as  follows: 

"Mrs.  A.  has  trouble  seeing  and  counts  on  me  to  help  get  her  to  the  health  cen- 
ter for  appointments.    On  the  way  home,  I  usually  do  some  shopping  for  her... Mrs.  B. 
uses  a  walker  and  I  am  arranging  for  her  to  get  a  wheel  chair  so  she  can  get  around 
better... I  helped  make  arrangements  for  Mrs.  D's  child  to  get  into  the  hospital  since 
Mrs.  D.'s  English  isn't  too  good... Mrs.  E.  says  her  80  year  old  mother  needs  privacy 
and  asked  if  I  can  help  get  an  apartment  with  one  more  room.    A  teen-age  girl  wants 
an  appointment  to  discuss  birth  control.     She  wants  me  to  explain  what  the  nurse  will 
do  and  set  up  the  appointment. 

"The  internist  asks  me  to  check  the  blood  pressure  of  a  hypertensive  patient... 
The  pediatrician  asks  me  to  evaluate  the  possibility  of  child  neglect.    One  of  the 
children  had  been  burned  twice  by  hot  liquid... The  nurse  asks  me  to  bring  penicillin 
to  a  patient  who  has  no  phone . " 

The  Center  feels  that  the  family  health  worker  provides  the  needed  sense  of 

continuity  for  the  families  under  her  care,  and  helps  ameliorate  the  high  turnover  of 

doctors . 

The  team's  nurses  are  each  responsible  for  650-750  patients  covered  by  three 
family  health  workers.    They  instruct  and  assist  the  family  health  worker  in  medica- 
tion and  medical  procedures,  and  after  briefing  by  the  doctors,  care  for  many  of  the 
patients  on  follow-up  visits.     They  are  responsible  for  medical  chart  supervision. 
"During  one  recent  day,"  reports  a  team  nurse,  "I  interacted  with  family  health  workers 
18  times... I  communicate  with  the  team  physicians  several  times  throughout  the  day." 

Direct  patient  care  at  the  Center  takes  up  the  major  portion  of  the  day  for  the 
team  physician,  who  is  responsible  for  about  2,400  patients.    A  team  pediatrician 
reports : 

"I  have  eight  clinical  sessions  per  week.     I  see  an  average  of  seven  to  eight 
patients  per  session.     In  a  set-up  like        this  Center,  one  realizes  that  one's  re- 
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sponsibility  to  the  patient  does  not  end  with  just  looking  after  the  medical  problem... 
I  spend  some  of  my  time  writing  letters  for  better  housing  facilities  and  more  finan- 
cial assistance;  contacting  the  Bureau  of  Child  Welfare  in  cases  of  neglected  children; 
talking  with  school  guidance  counselors;  teaching  mothers  preventive  as  well  as  acute 

medical  care... These  problems  are  not  solved  overnight,  but  I  get  a  good  feeling  of 
satisfaction  whenever  we  are  able  to  help  even  just  one  or  merely  scratch  the  surface 
of  another." 

In  addition  to  informal  conferences  throughout  the  day,  the  team  schedules  a 
regular  session  at  which  all  members  meet  for  one  hour  a  week. 

The  testimony  from  many  team  members  —  perhaps  "testimonials"  would  be  more 
apt  —  show  their  strong  commitment  to  team  practice.    But  the  smooth  functioning  of 
the  teams  evolved  slowly.     In  the  beginning,  family  health  workers  resented  their  be- 
ing regarded  by  nurses  and  doctors  as  mere  "messengers."    Doctors  complained  that 
nurses  were  "subservient"  ana  avoided  decision-making.    iSfurses,  on  the  oxher  hana,  re- 
sented traditionally- trained  doctors  whose  attitude  was  "I  am  the  physiciaji  and  I  make 
the  decisions."    Doctors  were  criticized  for  "talking  too  much,"  and  trying  to  domi- 
nate team  meetings.     It  took  years  of  conscious  effort  by  all  team  members  to  get  the 
teams  to  mesh  smoothly  and  to  emerge  as  tight-knit  "family"  groups.     The  extent  to 
which  that  transformation  has  taken  place  is  seen  in  the  comments  of  a  team  internist: 

"No  one  on  the  team  is  alone  with  problems  of  any  one  patient  and  the  sharing 
is  comforting. . .After  learning  to  eat  chitlins  with  sangria,  doing  the  Puerto  Rican 
bolero  with  my  white  Ozark  savoir-faire  and  ushering  at  the  wedding  of  a  family  health 
worker's  daughter. .  .being  a  member  on  an  l-llK  team  begins  moving  from  the  pages  of  a 
treatise  on  social  psychology  to  a  vital,  rewarding  experience  —  tmd  I  find  myself  in 
a  position  that  I  really  like." 
2.  Medical  Record  Keeping 

Registration  at  the  Center  is  by  family.    A  Family  Registration  form  collects 
family  and  household  identification  information  (names,  address,  telephone  number, 
weekly  incomes  of  family  members,  insurance  data,  e.g.  Medicaid  number).    Each  record 
is  assigned  a  five-digit  family  identification  number,  and  each  member  is  then  given 
a  two-digit  prefix  number,  e.g.  head  of  household.     This  is  an  internal  record-keep- 
ing device;  the  Social  Security  number  is  not  used  as  a  patient  identifier  as  it  is 
in  some  health  care  institutions. 

Each  patient  within  the  family  is  then  given  his  or  her  own  individual  record 
which  contains  the  results  of  regular  check-ups:  x-ray  reports,  laboratory  summary 
sheet,  ECG  results,  as  well  as  a  continuing  record  of  any  additional  medical  care. 

It  also  contains  a  No-Show  record,  which  we  will  discuss  shortly. 

Since  1970,  the  Center  has  been  using  the  problem-oriented  record  (POS)  devel- 
oped by  Dr.  Lawrence  Weed,  who  visited  the  Center  in  ^9ba  to  explain  his  concej^te  to 
the  staff.    Instead  of  filing  items  chronologically  in  a  medical  record,  with  summer- 
ies  written  whenever  a  fresh  complaint  is  met,  the  POR  technique  is  based  on  develop- 
ment of  a  "patient  profile"  that  includes  both  social  history  and  medical  treatments; 
a  problem  list  that  identifies  the  chief  current  problems  and  serves  as  an  "issue- 
oriented"  table  of  contents  to  the  full  record;  an  initial  plan  of  management  for 
each  item  on  the  problem  list;  and  progress  notes  geared  specifically  to  each  item 
listed.     The  Center  started  using  the  Weed  system  in  1970  with  training  sessions  in 
its  proper  use;  between  a  third  and  a  half  of  the  charts  are  now  kept  in  that  form. 
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Computer  Development 

In  its  first  few  years,  the  Center  did  billings,  payroll,  and  basic  reports  on 
a  small  computer,  using  batch-processing.     Several  important  research  studies  of  commu- 
nity heal-th  needs  and  patient  utilization  of  the  Center  were  conducted  through  the  aid 
of  computer  data  analysis,  as  well  as  a  statistical  audit  of  service  delivery  by  pro- 
fessionals and  staff  teams,  made  possible  by  disposition  sheets  produced  by  computer. 

In  1971,  the  Center  moved  to  am  on-line  computer  system.     The  picture  of  record 
keeping  in  the  Center's  Report  for  that  year  graphically  explains  why  the  administra- 
tion felt  a  need  to  turn  more  heavily  to  computers.     It  described  proliferating  paper 
for  which  there  was  no  room;  delayed  or  missing  lab  reports;  duplicate  appointments 
and  mistaken  appointments  causing  "at  least  half  of  the  no-shows;"  incorrect  billing; 
unfiled  records  and  laboratory  reports;  and  government  reports  not  forwarded  by  the 
required  dates. 

With  its  1971  expansion,  the  Center  not  only  worked  on  those  problems  but  also 
developed  a  monthly  "profile"  on  each  patient  who  had  a  medical  transaction  the  previous 
month.     This  profile  was  attached  to  the  patient's  folder  and  was  designed  for  both 
administrative  and  direct-care  purposes.     It  served  to  update  billings,  flag  routine 
treatments  due,  print  out  a  problem-oriented  table  of  contents  to  facilitate  chart 
review,  reduce  duplicate  appointments,  remind  physicians  about  drug  sensitivities ,  and 
"identify  and  focus  attention  upon  ' overutilizers '  ajid  'underutilizers. ' " 

The  computer  was  also  used  in  1971  to  process  the  results  of  a  door-to-door 
survey  conducted  by  Center  personnel  to  validate  and  update  patient  registrations, 
collect  data  to  justify  insurance  payments  for  registered  patients,  and  assign  a  pri- 
ority based  on  medical  need  for  the  processing  of  new,  unregistered  residents. 

The  Center  also  expanded  during  1971  its  "management  information  system,"  (MIS) 
designed  to  provide  the  "timely  and  accurate"  data  "to  formulate  decisions  governing 
operations  of  the  Health  Center,  such  as  staffing,  scheduling,  etc."    This  MIS  work 
was  based  on  a  set  of  weekly  computer-generated  tables  reporting  various  activities 
(such  as  patient  encounters)  during  the  previous  week.     The  tables  allowed  management 
to  monitor  individual  and  unit  performance,  and  made  possible  better  projections  of 
monthly  and  annual  patient  volumes. 

Computer  development  continued  actively  during  1 972  and  the  Center  installed  a 
larger,  IBM  360  system  In  early  1973.         Today,  it  has  major  application  systems  for 
registrations,  appointments,  laboratory  tests,  billing,  patient  encounters,  payroll 
and  personnel,  quarterly  reports,  and  integrated  management  information.     Several  of 
these  are  worth  noting  for  our  profile,  since  they  show  how  patient-care  operations 
are  affected  by  computer  use. 
1 .  Appointments 

"Appointment  Central,"    a  section  of  the  health  services  department,  generates  a 
master  schedule  of  all  appointments  and  produces  a  weekly  appointment  sheet  for  each 
practitioner  seven  weeks  in  advance  of  scheduled  dates.  Appointment  sheets  from  each 
health-care  unit  are  collected  two  days  prior  to  the  session  and  are  checked  against 
a  preliminary  printout  furnished  by  the  computer  and  last  minute  appointments,  such 
as  special  follow-ups,  are  added.     The  sheets  are  sent  to  each  health-care  unit  at  the 
beginning  of  the  month  in  which  the  appointment  is  made,  and  the  receptionist  mails  a 
notice  to  the  patient. 
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"Appointment  Central"  plans  to  install  as  soon  as  possible  an  on-line  appointment 
system  listing  all  scheduled  appointments  for  a  patient  (thereby  avoiding  duplicate 
appointments  with  a  single  practitioner  and  simultaneous  appointments  with  two  differ- 
ent practitioners)  and  also  displaying  on  a  terminal  screen  the  available  appointments 
for  a  practitioner  at  any  given  session. 

2.  Laboratory  System 

The  "Lab  Central"  application  has  automated  much  of  what  used  to  be  manual  lab- 
oratory clerical  work.     Test  results  are  first  verified  in  the  lab  as  having  been  com- 
pleted and  are  then  sent  to  "Lab  Central,"  where  they  are  coded  and  processed  in  the 
keypunch  and  data  processing  divisions.     "Stat"  work  is  done  and  reported  immediately, 
and  physicians  can  now  secure  reports  such  as  chemistries,  urinalysis,  and  wet  preps 
within  a  24-hour  period,  where  these  once  took  2-3  days.     Comparisons  between  ordered 
and  completed  lab  work  are  still  done  substantially  by  hand,  but  a  new  system  being 
installed  will  permit  recording  the  receipt  of  a  lab  result,  even  if  the  actual  report 
must  be  forwarded  physically  to  the  medical  records  department  for  filing. 

3.  Billing  System 

The  billing  system  takes  encounter  data,  compares  it  against  the  master  roster 
and  produces  a  billing  history  file  used  to  generate  Medicaid  and  Medicare  bills. 
Although  the  billing  system  has  been  sufficiently  developed  to  bill  Medicare  and  Medi- 
caid with  reasonable  accuracy,  the  Center  still  has  problems  with  inaccurate  billing 
on  the  master  file  and  missing  billing  information  relating  to  patients  eligible  for 
Medicare,  and  it  is  continuing  to  work  on  those  problems.    Manual  follow-up  after 
treatment  is  still  used  to  record  the  treatment,  diagnosis,  and  name  of  the  attending 
physician,  since  it  is  ofttn  aifficult  to  obtain  all  of  this  at  the  time  of  treatment, 
when  the  patient  encounter  form  is  completed. 

4.  Reporting 

The  Center  is  required  to  submit  statistical  utilization  reports  at  quarterly 
inteznAals  to  the  Department  of  Health,  Education  and  Welfare,  basically  to  "justify 
(the  Center's)  existence  to  the  people  in  Washington."    The  computer  makes  it  possible 
to  supply  the  data  that  HEW  requires,  such  as  the  number  of  patients  registered  and 
receiving  care  within  a  given  time  period;  the  number  of  visits  to  each  unit  of  the 
Center  during  that  period;  and  the  number  of  patients  registered  per  physician  or 
health  care  team. 

5.  Research 

The  Center's  administration  has  used  its  "data  base  of  medical,  demographic,  and 
management  information"  to  support  a  variety  of  research  projects  in  recent  years. 
Most  have  been  geared  to  improvement  of  the  Center's  medical  and  social  programs.  For 
example,  as  part  of  the  lead-poisoning  campaign  described  earlier,  reports  of  lead- 
poisoning  cases  were  fed  into  a  computer  file  of  buildings  and  registered  children  to 
generate  reports  about  children  in  danger  of  becoming  poisoned  who  had  not  yet  been 
contacted  or  treated.    Other  studies  have  involved  productivity  analysis  and  patient 
flows  in  the  pediatrics  department,  as  well  as  the  incidence  of  various  specific  dis- 
eases and  conditions. 

Overall,   Center   Director  Deloris  Smith  believes  that  the  computer  has  been  a 
good  tool.     She  says  it  has  reduced  the  number  of  personnel  needed  in  the  medical  re- 
cords and  billings  departments;  "beefed  up"  financial  analysis  and  reporting;  and  pro- 

IH9 


vided  the  central  administration  with  "useful  information  rather  than  a  lot  of  useless 
print-out . " 

Even  more  significantly,  though  the  top  administrators  and  the  data  processing 
staffs  are  thoroughly  aware  of  the  specific  computer  sj^stems,  the  nurses,  family  health 
workers,  and  practitioners  whom  our  project  interviewed  were  not  particularly  aware  of 
what  patient  data  were  stored  in  the  computer  or  how  the  various  application  systems 
worked.     They  simply  took  the  computer-assisted  operations  for  granted,  and  had  learned 
what  they  needed  to_,  in  order  to  use  the  EDP  equipment.     They  felt  no  conflict  between 
their  missions  and  the  on-going  computer  development. 

This  underscores  a  point  made  in  the  Center's  Fourth  Annual  Report  (1971)  hy 
its  then  Director,  Dr.  Harold  Wise.    Once  organizations  move  to  "complicated  technology," 
Dr.  Wise  noted,  even  in  supposedly  "consumer-controlled"  organizations,  "the  real  con- 
trol" usually  "is  taken  over  by  the  managers ...  the  layman  must  depend  on  the  expertise 
of  those  who  work  with  technology  to  make  the  decision."    This  was  especially  true  in 
the  health  area,  he  noted,  where  the  technology  "is  complicated,  magical  and  mysteri- 
ous, and  the  quality  of  service  difficult  to  monitor."    One  does  not  feel  this  from 
observing  the  daily  routine  or  talking  to  staff  at  Martin  Luther  King.     There  is  no 
sense  of  roles  having  been  reorganized  around  "computer  needs"  but,  rather,  of  the 
basic  health-team  approach  and  staff  social-advocacy  activities  having  been  intelli- 
gently supported  by  EDP  capabilities.    Uo-one  visiting  the  Center  would  imagine  that 
the  systems  analysts,  rather  than  Deloris  Smith  and  her  colleagues,  are  in  charge  here. 

Citizen  Rightg  at  the  Kin^  Center 

The  conventional  wisdom  is  that  the  poor  are  so  beset  by  the  problems  of  econom- 
ic survival  — unemployment,  poor  housing,  undernourishment  — that  refinements  like  dig- 
nified treatment,  including  privacy,  are  unimportant  or  at  least  secondary  considera- 
tions.    This  conception  of  economic  priorities  is  an  arguable  one.     To  site  several 
noted  instances  that  run  counter  to  this  judgment,  and  involve  Dr.  King's  own  campaigns, 
we  need  only  recall  that  the  Montgomery,  Alabama  bus  boycott  of  1956  did  not  begin  be- 
cause the  poor  blacks  of  Montgomery  were  seeking  lower  bus  fares.     They  were  protesting 
the  indignity  of  being  forced  to  sit  in  the  back  of  the  bus.     Similarly,  while  Dr. 
King's  campaign  in  1963  against  segregation  in  Birmingham  was  directed  partly  against 
job  discrimination,  the  issue  that  struck  the  deepest  chord  in  the  local  black  commu- 
nity, and  became  the  focus  of  national  demonstrations  leading  up  to  passage  of  the 
federal  civil  rights  act  of  1964,  was  also  a  "dignity  issue"  --the  refusal  of  white 
merchants  to  serve  blacks  at  lunch  counters  and  other  public  accommodation  facilities. 

The  Center's  Health  Advocate  (a  position  created    to  represent  and  protect 
patients'  interests)  put  it  this  way:  "Traditionally,  health  facilities  are  not  inter- 
ested in  dealing  with  the  rights  or  feelings  of  the  patients.     At  MLK,  we  feel  that 
being  sensitive  to  the  emotional  needs  and  desires  of  a  patient  is  as  much  an  integral 
part  of  the  treatment  plan  as  the  actual  prescribing  of  medicine." 

While  it  knew  that  these  were  its  objectives,  it  took  the  Center  about  a  year 
to  formulate  what  patients'  rights  meant  in  practice,  since  there  were  no  ready  models 
to  copy  from  other  health  centers,  or  in  the  health  literature,  or  in  legal  procedures. 
A  survey  was  conducted  among  patients,  staff,  and  administration  to  find  out  "what 
patients'  rights  meant  to  each  of  them"  and  what  should  be  formally  declared  by  the 
Center.    This  led  to  the  writing  of  a  clear  and  cleverly  illustrated  booklet,  "Tour 
Rights  as  a  Patient,"  done  in  both  English  and  Spanish.    At  the  same  time,  the  Center 
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adopted  a  formal  grievance  procedure  for  patients  and  made  the  Health  Advocate  a  repre- 
sentative of  the  patient,  who  was  to  follow  all  grievances  to  insure  their  proper 
handling. 

The  rights  set  out  in  the  booklet  are:   (1)  the  right  to  courtesy  and  respect, 
(2)  the  right  to  refuse  treatment,  (3)  the  right  to  a  clear  explanation  of  procedures 
and  treatment,  (4)  the  right  to  privacy,  (5)  the  right  to  choose  a  convenient  time  for 
appointments,  (6)  the  right  to  transportation  to  and  from  the  Center  when  disabled, 
(7)  the  right  to  assistance  in  applying  for  Medicaid,  and  (8)  the  right  to  informed 
consent  with  respect  to  the  exchange  of  information  between  the  Center  and  other 
agencies  (e.g.,  schools  and  referrals). 

How  several  of  these  rights  are  explained  to  patients  deserves  reproduction 
here  from  the  booklet: 


DIGNITY 


You  have  the  right  to  be  treated  with  respect.  You  should 
be  called  Mr.  Jones,  not  number  231,  and  not  Jones. 
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RIGHTS  IN  THE  TREATMENT  ROOM 


a)      The  patient  has  a  right  to  consent  to,  or  refuse  any 
treatment. 


b)  The  patient  has  a  right  to  have  things  explained  clearly. 
(For  example,  any  possible  side  effects  of  medicines.) 

c)  The  patient  has  the  right  to  refuse  treatment  by  any  phy- 
sician and  to  request  a  different  doctor. 
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PRI7ACY 


a)      No  employee  should  talk  to  you  about  your  problems  in 
the  waiting  room  or  halls  or  where  others  may  hear. 


b)      No  one  should  call  across  the  room  for  personal  infor- 
mation.   For  example,  "Do  you  have  Medicaid?"  etc. 
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c)  You  have  a  right  to  consent  to  any  visit  to  your  home. 
If  at  all  possible  you  should  know  in  advance  when  the 
visit  will  take  place. 


d)      You  have  a  right  to  refuse  to  participate  in  or  be  inter- 
viewed for  research  purposes.  You  have  the  right  to  full 
explanation  of  purposes  and  uses  of  the  information  if  you 
do  participate. 


CONFIDENTIALITY 


b)      The  patient  has  a  right  to  see  letters,  know  about 
conferences  about  him  and  results  of  conferences. 
(Patients  must  sign  all  letters.) 
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The  booklet  concludes  with  an  explanation  of  the  complaint  procedures,  and  con- 
tains a  complaint  form  which  can  be  detached  and  mailed  in  to  the  Community  Health 
Advocacy  Department. 

The  Center's  booklet,  it  believes,  was  the  first  such  publication  for  patients 
in  the  country.     Since  then,  it  has  been  widely  copied  by  community  health  centers, 
though  not  by  many  government  hospitals  or  private  health  centers. 

According  to  the  Health  Advocate,  Liery  Wynn,  "the  Patients'  Rights  pamphlet  led 
to  changes  in  the  sj'-stem  of  health  care  delivery."    The  way  in  which  the  rights  it  iden- 
tified have  been  further  defined  and  treated  in  practice,  and  how  conflicts  between 
Center  positions  and  outside  pressures  have  been  handled,  were  a  primary  focus  of  our 
visit  to  the  King  Center,  and  produced  the  following  detailed  portrait. 
1 .  Right  to  information 

The  Center's  pamphlet  tells  patients  "You  have  a  right  to  know  what  is  going  on. 
Always  ask  questions  about  anything  that  you  do  not  understand  or  that  is  worrying  you." 
Probably  the  most  usual  mechanism  for  enforcing  this  right  is  the  close  bond  between 
the  Family  Health  Worker  and  the  patients;  the  health  workers  are  often  not  only  ex- 
plaining terms  and  procedures  but  also  telling  the  doctors  and  nurses  that  the  patient 
is  uneasy  or  wants  further  explanation,  and  seeing  that  this  is  provided. 

Two  examples  of  such  practice  came  in  interviews  with  Family  Health  Workers  that 

have  been  published  by  the  Center.     The  first  was  with  a  Mrs.  Montgomery: 

"I  know  I  used  to  go  to  Morrisania  Hospital  before  the  King  Center  opened. 
And  the  doctor  would  come  into  the  room  and  I  knew  when  I  told  him  I  had  a  headache, 
he  was  going  to  give  me  an  aspirin  for  that  headache,  and  in  two  seconds  he  had  gone 
to  another  patient.     They  really  don't  give  you  any  time  to  question  or  they  look  at 
you  like  you  are  a  specimen,  as  if  to  say,   'You  don't  talk  back  to  me.     I  just  tell 
what's  going  to  happen  to  you  and  that's  it.'    And  they  just  walk  away.  Sometimes 
even  if  you  ask  them  a  question,  you  don't  get  any  answer.    Or  if  you  get  an  answer 
they  brush  it  right  off,  and  that  sort  of  turns  you  off  right  there.    And  I  think 
that  is  where  the  King  Center  is  unique,  because  you  can  talk  to  most  of  the  doctors 
here.    If  a  patient  has  a  problem  speaking  to  a  doctor,  he'll  come  to  a  family  health 
worker  and  tell  her,   'Look,  I  asked  him,  but  I  didn't  get  the  right  answer.'    And  then 
we,  in  turn,  would  go  back  to  the  doctor  and  we  would  speak  to  the  doctor  and  tell  him. 
'This  patient  does  not  understand  what  is  happening.     Will  you  explain  it  to  her?'  And 
most  of  the  time  the  doctors  will.     I  think  that's  one  way  that  we  are  very  good." 

Another  health  worker,  Mrs.  Lamot,  described  her  experiences  this  way: 

"One  of  the  things  that  has  helped  us  encourage  patients  to  do  this  is  that 
pamphlet  that  we  have  on  patients'  rights.     I  explain  to  the  patients  that  if  they  go 
to  see  a  doctor  and  they  ask  questions  and  get  an  answer  that  they  are  not  satisfied 
with  or  if  they  are  not  being  treated  properly,  they  have  the  right  to  go  to  the  family 
health  worker  or  the  person  in  charge  of  the  patients'  rights  and  complain.    When  we 
are  on  our  home  visits  we  counsel  the  patient;  we  tell  them  to  just  come  out  and  talk 
to  the  doctor  and  don't  be  afraid  because  we  constantly  remind  them  that  they  have 
rights  as  patients.     You  know  in  other  clinics  the  patients  are  afraid  to  speak  up. 
But  they  are  not  here  because  we  enforce  the  rule,  and  we  teach  them  how  to  ask  ques- 
tions.    They  know  that  they  can  depend  on  family  health  workers  which  is  good  because 
I  want  them  to  know  that  they  have  rights  so  there  is  a  good  understanding  between 
the  patients  and  the  Center  staff. 

How  Mrs.  Lamot  does  this  was  the  subject  of  the  following  exchanges: 

Interviewer: 

Let's  say  for  example,  that  a  patient  comes  in  with  diabetes,  and 
he  has  been  put  on  a  special  diet  and  has  to  take  certain  pills.  He 
knows  that  he  has  to  do  these  things  but  he  is  not  exactly  sure 
why.  How  would  you  encourage  him  to  get  information  about  the 
treatment?  How  would  you  get  him  to  speak  not  only  to  you  but 
to  ask  the  doctor?  How  would  you  encourage  him  to  ask  questions? 
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Mrs.  Montgomery: 

If  a  patient  came  to  me  and  said,  "I  found  out  that  I  am  a 
diabetic,  and  I  know  I  have  to  be  on  a  special  diet  and  take 
special  medication,"  I  would  explain  to  the  patient  as  well  as  I 
could  about  his  diet  and  medication.  If  he  is  still  not  fully  satisfied, 
then  I  would  take  the  patient  back  to  the  doctor.  The  three  of  us 
would  sit  down  and  the  doctor  would  go  over  the  whole  routine 
with  the  patient:  let  him  know  just  what  he  has  to  take.  In  that 
way  I  would  get  the  same  information  from  the  doctor  as  the 
patient,  so  then  I  could  reinforce  the  information  the  doctor  told 
Itim. 

Interviewer: 

How  would  you  actually  go  about  getting  the  patient  to  ask  the 
doctor  die  right  questions  so  that  in  the  future,  when  you  are  not 
around,  he  would  know  the  right  questions  to  ask?  How  do  you 
teach  the  patient  not  to  accept  pills  without  knowing  what  they're 
really  for? 
Mrs.  Montgomery: 

1  think  that  would  really  be  patient  education.  When  you  go  to 
the  family  you  have  to  say  to  them,  "Look  don't  accept  everytliing 
that  anybody  gives  you.  Question  that.  You  have  a  right  to  ques- 
tion it.  Wlienever  you  go  to  get  medications  or  diets  or  anything 
feel  free  to  ask  that  doctor  what's  happening  with  you."  I  think 
it's  up  to  the  doctor  too.  If  a  patient  can  go  to  a  doctor  knowing 
that  he  can  ask  him  really  anything  very  simple  and  the  doctor 
answers  that  patient  nicely,  I  am  quite  sure  that  when  the  patient 
really  has  questions  he  will  not  be  afraid  to  ask  the  doctor.  Patients 
follow  directions  a  lot  better  when  they  understand  what  is  behind 
them. 

Interviewer: 

Do  you  think  that  there  is  some  set  of  questions  that  you  can 
teach  patients  so  that  they  know  that  when  they  have  a  meeting  or 
an  appointment  with  the  doctor  there  should  be  certain  questions 
they  should  always  ask— there  is  certain  information  that  they  should 
walk  out  of  that  office  knowing? 
Mrs.  Montgomery: 

Yes.  If,  for  example,  a  doctor  is  going  to  change  a  patient's 
medication  or  even  if  it's  an  old  medication,  the  patient  should 
speak  to  the  doctor  and  ask  him,  "What's  going  to  happen  if  I  take 
this  pill?  Am  I  going  to  have  a  side  effect?  Am  I  going  to  break 
out  in  a  sliglit  rash?  WiU  I  have  a  headache?"  And  I  think  patients 
should  be  aware  of  the  questions  that  they  can  ask. 
Interviewer: 

Have   you   gotten   any    specific    comments   from  patients  about 
family  health  workers  and  how  the  situation  in  this  community  lias 
changed? 
Mrs.  Lamot: 

I  think  we  have  been  going  through  three  stages.  The  first  stage 
was  kind  of  friglitening  because  we  were  trying  to  feel  our  way  in 
the  community— trying  to  sell  the  Center  and  our  services  to  the 
community.  In  the  second  stage  we  learned  how  to  get  a  lot  of 
things  done  and  people  gained  confidence  in  us.  We  did  many 
things  for  our  patients.  We  helped  them  with  many  problems.  We 
were  doing  so  much  I  think  we  made  them  dependent  on  us.  You 
know,  we  were  running  to  welfare,  to  the  hospital  and  so  forth, 
and  they  looked  forward  to  those  things.  Now,  in  the  third  stage,  I 
think  we  have  to  learn  to  teach  them  how  to  help  themselves, 
because  tliat  is  part  of  our  job— to  teach  through  patient  education. 
It  is  kind  of  hard  for  them  to  accept  this  because  they  have 
depended  on  us  for  so  long. 
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Patients  are  told  that  they  have  a  right  to  be  informed  about  their  records.  In 

1970,  Dr.  Harold  Wise,  the  Director,  saw  a  full  right  of  access  to  the  record  as  an 

important  element  on  the  Center's  "consumer  protection"  goals. 

"In  an  effort  to  fully  inform  patients  who  wish  to  learn  about  their  health 
status,  the  medical  record  should  be  made  available  to  the  patient.     Those  patients 
who  wish  should  write  a  'progress  note'  in  the  chart.     Such  a  change  in  tradition 
would  require  considerable  discussion  with  health  workers  who  are  trained  to  use 
words  like  'mitotic'  for  cancer  and  'lues'  for  syphilis,  and  whose  usual  attempts 
at  communication  confound  the  average  patient.     The  idea  is  that  health  workers  should 
spell  out  to  patients  the  alternatives  of  any  health  treatment  plan,  encouraging  the 
patient  to  make  his  own  decision  as  to  choice  of  alternatives." 

Such  record  reviews  do  not  seem  to  have  developed,  except  as  part  of  the  use 

of  the  Weed  problem-oriented  record,  with  its  discussion  with  the  patient  of  his/her 

chief  complaints,  treatment  plan,  and  progress  notes. 

Liery  Wynn,  the  Health  Advocate,  reports  that  he  has  heard  of  only  a  few  re- 
quests by  patients  to  inspect  their  records.     "The  record  would  not  be  much  use  to  the 
patient,  anyway,"  he  observed.     "He  probably  wouldn't  be  able  to  read  or  understand 
much  of  the  material  in  it."    However,  a  patient  is  shown  the  record  if  he  or  she  in- 
sists. 

2.  Privacy 

The  Center  treats  privacy  in  terms  of  respect  for  the  individual's  dignity  — 
not  exposing  his  or  her  medical  situation  to  those  staff  members  who  do  not  need  to 
know  it,  or  to  other  residents  who  may  be  around  the  Center  when  the  patient  is  there. 
This  is  expressed  in  the  guide  for  medical  assistsints  used  at  the  Center,  which  con- 
tains instructions  such  as  these: 

"The  patient-practitioner  relationship  is  a  private  one,  and  nothing  that  is 
said  in  the  office  is  to  be  repeated.     Another  method  of  insuring  this  privacy  is  to 
respect  the  closed-door  policy.     The  only  way  to  communicate  when  a  patient  is  in  the 
office  is  by  telephone,  and  this  is  to  be  used  only  when  absolutely  necessary. 

"When  the  patient  is  to  be  examined,  the  assistant  should  instruct  him  about 
dress  preparation.    When  the  patient  is  properly  stripped  and  on  the  examination  table, 
the  medical  assistant  should  cover  his  body  loosely  with  a  sheet,  if  necessary,  to 
insure  privacy." 

However,  if  one  uses  the  term  privacy  as  we  have  generally  done  in  this  study  — 
to  refer  to  the  right  not  to  have  someone  collect  irrelevant  or  highly  sensitive  per- 
sonal data  about  an  individual  —  then  this  simply  does  not  arise  as  a  consideration 
at  the  King  Center.     Implicit  in  the  ideas  of  team  medicine  and  comprehensive  care  is 
the  ability  to  collect  as  much  non-medical  data  about  the  family  as  possible  to  help 
treat  the  social  problems  of  the  patients  along  with  their  medical  problems.    ALL  data 
is  regarded  as  relevant.     It  will  be  recalled  that  when  Dr.  Lloyd  objected  to  the 
setting  of  a  means  test  by  GEO  in  1971  ,  he  did  so  not  on  grounds  that  it  would  require 
the  patient  to  reveal  information  about  his/her  income,  but  only  on  the  grounds  that 
it  would  deny  care  to  people  who  needed  it. 

3.  Confidentiality:     Within  the  Center 

Family  health  workers  receive  four  hours  of  instruction  on  patients'  rights  in 
their  training  programs,  as  well  as  a  discussion  of  "Ethics  and  Conduct"  that  speci- 
fically includes  "Confidentiality  of  records,  medical  information,  patient  information." 

This  is  considered  vital  because  team  medicine  at  the  Center  means  that  informa- 
tion elsewhere  restricted  to  the  patient's  doctor  or  nurse  is  shared  with  the  entire 
team,  including  the  non-medical  family  health  workers.     In  recognition  of  the  special 
problems  created  by  this  broadened  dissemination  of  information,  the  Center  has  adopted 
the  following  rules  to  guard  patient  confidentiality: 
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A.  Breach  of  confidentiality  constitutes  just  cause  for  automatic  dismissal. 
According  to  Health  Advocate  Wynn,  every  employee  at  the  Center  is  well  aware  of  this. 
In  one  case,  an  employee  was  dismissed  for  telling  another  about  something  he  had  read 
in  a  patient's  chart. 

B.  The  teams  have  adopted  the  rule  that  the  confidentiality  of  patient  infor- 
mation exchanged  in  team  meetings  must  be  respected.     The  family  health  worker,  to 
whom  much  sensitive  information  is  revealed,  does  not  write  down  the  substance  of  con- 
fidential communications  on  the  record.     Instead,  he  or  she  puts  a  "see  me"  note  to 
the  physician  in  the  patient's  file. 

C.  The  presence  of  non-team  members  at  weekly  team  meetings  is  carefully 
screened.    Non  members  may  attend  only  the  part  of  the  meeting  for  which  they  were 
invited,  and  their  visits  must  be  occasioned  by  team  or  patient  need.     Certain  types 
of  problems,  such  as  marital  difficulties,  are  not  discussed  in  front  of  visitors. 

D.  Another  way  in  which  information  about  patients  is  shared  among  non-medi- 
cal personnel  is  through  the  Medical  Care  Evaluation  Committee  which  evaluates  team 
care  of  patients  (usually  by  family).     The  Committee  consists  of  the  Medical  Director, 
senior  internist,  pediatrician,  obstetrician,  nurse,  nurse  supervisor.  Community 
Health  Advocate,  family  health  worker  and  dentist.     The  Committee  reviews  patient 
charts,  conducts  a  review  of  deaths,  adverse  reactions  to  drugs  administered  at  the 
Center,  and  hospital  referrals.    Of  these,  the  most  sensitive  is  chart  review,  since 
obviously  in  the  course  of  analyzing  whether  the  medical  team  in  question  has  pro- 
vided adequate  care,  it  also  exposes  the  family's  entire  medical  background  to  those 
not  directly  involved  in  its  care. 

The  nurse  who  serves  as  secretary  to  the  Committee  comments:   "Strict  confiden- 
tiality concerning  Committee  meetings  and  actions  was  enforced  and  it  was  made  clear 
that  ajiy  breach  of  confidentiality  could  serve  as  a  basis  for  dismissal  from  the 
Committee. " 

The  Community  Health  Advocate's  role  on  the  Committee  is  to  bring  major  com- 
plaints by  patients  to  its  attention  for  corrective  action,  and  also  to  submit  a  con- 
sumer satisfaction  form  for  the  family  whose  chart  is  being  audited.     This  form  indi- 
cates that  the  family  has  been  made  aware  of  the  services  the  Center  offers ,  and  com- 
ments on  the  quality  of  those  services. 

E.  Special  attention  is  paid  to  the  confidentiality  of  information  about 
minors.    Because  the  Center  not  only  treats  minors  but  also  runs  special  health  edu- 
cation programs  in  the  schools  and  in  teen-age  clinics,  it  learns  of  highly  sensitive 
information  about  young  people  —  matters  such  as  venereal  disease,  pregnancy,  sex 
disorders,  drug  and  alcohol  abuse,  homosexuality,  and  others.     The  Center  sees  a 
"troublesome"  issue  in  deciding  when  to  secure  parental  consent  and  when  to  treat  the 
minor  without  such  notification:  For  example,  the  Center's  rules  are  that  emancipated 
minors  are  treated  under  their  own  consent.     Certain  "mature  minors"  close  to  but  not 
yet  of  legal  age  and  with  "sufficient  understanding  to  know  the  significance  of  the 
consent  and  the  reason  therefore"  will  also  be  treated  but  the  Center  believes  that 
"the  safer  practice  is  to  require  parental  consent  in  these  situations."    If  the 
parent  refuses  consent,  a  court  order  may  be  sought  to  authorize  treatment  the  Center 
and  the  minor  feel  necessary.    Venereal  disease  in  New  York  may  be  treated  in  minors 
without  parental  consent.     Interviews  with  family  health  workers  confirm  their  criti- 
cal role  in  assuring  young  people  who  come  for  treatment  that  the  doctors  and  nurses 
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will  not  tell  their  parents  about  things  they  wish  kept  confidential. 
4.     Confidentiality:     Outside  Agencies  and  Organizations 

The  Patient's  Rights  booklet  says  that  no  personal  records  are  released  to  out- 
side doctors,  health  facilities,  or  other  agencies  without  the  written  consent  of  the 
patient.     The  Center  must,  however,  comply  with  state  laws  requiring  reports  on  patients 
suffering  from  gunshot  wounds  and  cases  of  communicable  diseases,  and  practitioners 
tell  patients  that  they  will  have  to  do  this  when  they  begin  treatment.     Child  abuse 
must  also  be  reported,  and  —  along  with  child  neglect  reporting  —  this  can  raise 
some  difficult  problems  for  the  health  teams  to  resolve.    Here  is  one  account  of  a 
health  team  deliberation  about  a  child  neglect  report: 

"In  this  case,  the  pediatrician  felt  a  report  should  be  made,  and  the  family 
health  worker  and  public  health  nurse  disagreed.     Issues  of  fairness  to  the  family,  the 
possibility  of  death  or  injury  to  the  child,  and  the  effect  of  making  such  a  report 
on  the  team's  working  relationship  to  a  family  were  discussed.     The  family  health 
workers  were  generally  against  reporting  because  they  were  not  convinced  that  the 
Bureau  of  Child  Welfare  would  be  helpful  to  the  family,  and  they  wanted  'to  give  the 
parents  a  chance.'     The  physicians  were  for  reporting  because  they  had  seen  children 
maimed  for  life  and  also  felt  legally  responsible  for  making  the  report. 

"In  the  course  of  several  discussions. .. the  team  agreed  on  the  following 
policy:     Data  leading  to  suspicion  of  child  neglect  must  be  clearly  entered  in  the 
chart.     The  report  of  child  neglect  is  not  a  punitive  act;  it  may  result  in  help 
being  provided  to  a  family... The  parents  should  see  and  have  an  opportunity  to  discuss 
the  written  report  before  it  is  sent..." 

There  is  a  thread  of  feeling  that  runs  through  the  Center's  reports  that  does 
much  to  explain  its  practices  as  to  disseminating  patient  information  outside  the 
Center.    Given  the  recruitment  of  the  staff  from  the  community  and  the  resulting  iden- 
tification with  the  patients,  the  Center  's  personnel  generally  exhibit  a  feeling  of 
being  embattled  and  besieged  by  "outsiders";     by  federal  agencies  cutting  down  the 
grant  and  imposing  a  means  test  on  the  patients;  by  city  welfare  agencies  being  unre- 
sponsive to  their  patients'  needs;  by  Medicare  and  Medicaid  not  processing  claims 
promptly;  by  absentee  landlords  not  making  their  buildings  habitable.     This  sense  of 
embattlement  makes  the  Center "unco-operative "  when  outside  agencies  demand  information 
about  patients  that  will  probably  be  used  to  deny  them  rights,  privileges,  or  opportu- 
nities.    The  Center  bows  to  force  ma.jeur  when  it  has  to,  and  its  annual  reports  are  full 
of  explanations  about  why  certain  patient  information  must  be  supplied  to  payers,  wel- 
fare, etc.     But  even  then,  the  Center  maintains  an  active  law  department  that  brings 
test  cases  against  such  laws  or  regulations,  as  well  as  sponsoring  or  supporting  state 
legislation  to  increase  rights  of  confidentiality.     There  is  no  doubt  that  the  Center 
uses  its  resources  wherever  possible  to  protect  its  clients. 

Data  Security  and  Confidentiality 

The  central  processing  unit  of  the  Center's  computer  is  housed  in  a  locked  room 
alongside  the  room  where  about  a  dozen  staff  members  of  the  data  processing  division 
work  on  punched  cards,  print-outs,  and  data- input  procedures.    Keys  to  the  computer 
facility  are  issued  only  to  data  processing  personnel,  and  a  system  of  access  codes  is 
used  to  control  the  availability  of  medical  data  so  that  only  an  employee  with  a  need  to 
know  about  a  particular  data  file  can  obtain  a  print-out.     Similar  access  controls  will 
be  used  when  the  Center's  terminal  system  is  installed.     These  safeguards  are  seen  by 
the  Center's  data  processing  manager  as  the  right  level  to  deal  with  "any  realistic 
threats  to  what  we  have  here." 
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Grievance  Procedures  at  MLK 

The  Health  Advocate  estimates  that  his  department  gets  about  four  complaints  a 
week  of  which  half  have  to  do  with  administrative  matters  like  scheduling  and  appoint- 
ments.    The  others  are  "15%  about  employee  attitude,  30?^  about  treatment  given  by  a 
specific  employee,  and  5%  concern  employees  not  explaining  things  so  the  patient  can 
understand. " 

Three  fourths  of  the  complaints  are  resolved  simply  by  a  meeting  between  the 
Health  Advocate  and  the  staff  member  involved.     If  this  doesn't  work,  the  Health  Advo- 
cate goes  to  the  staff  member's  supervisor,  who  makes  a  decision  that  is  reported  to 
the  patient  within  five  days.     Ten  per  cent  of  complaints  are  resolved  this  way. 

If  the  patient  is  still  dissatisfied,  a  conference  between  the  Health  Advocate 
and -patient  is  held  with  the  staff  member  and  his  representative,  along  with  the  de- 
partment head,  to  thrash  the  matter  out.     Ten  per  cent  of  complaints  are  resolved  at 
these  conferences.     The  remaining  5"/°  are  those  in  which  several  patients  have  made 
similar  complaints  about  an  employee  procedure,  in  which  case  changes  are  recommended 
to  the  Project  Director  and  the  Community  Advisory  Board. 

In  some  circumstances ,  the  fact  that  an  advocate  is  an  employee  of  the  institu- 
tion would  cause  serious  concern  about  conflicts  of  interest.     Such  a  complaint  proce- 
dure in  a  police  department,  for  example,  usually  (and  often  justifiably)  raises  the 
cry  of  "whitewash."    Neither  community  groups  nor  the  Community  Advisory  Board  question 
the  advocate  process  at  the  Center,  however,  nor  did  any  persons  that  we  interviewed. 
The  definition  of  rights  is  so  strong  and  clear,  the  advocate's  role  as  the  patient's 
representative  is  so  firm,  and  the  presence  of  community  residents  on  the  advocacy 
staff  all  seem  to  prevent  any  tendency  for  the  advocate's  office  to  become  coopted  by 
the  "management." 

Center  Activity  on  City  and  State  Computer  Data  Systems 

Having  made  sure  there  is  no  conflict  between  its  patients'  rights  rules  and  its 
EDP    system,  the  Center  has  found  itself  embroiled  during  the  past  few  years  in  an  effort 
to  see  that  this  condition  is  not  compromised  by  efforts  to  build  regional  computerized 
data  systems. 

In  1971,  lawyers  from  the  Center's  Department  of  Community  Health  Advocacy  were 
appointed  to  a  confidentiality  subcommittee  of  the  New  York  City  Mayor's  Task  Force  for 
Comprehensive  Health  Planning.     The  subcommittee  was  formed  to  consider  what  protec- 
tions for  patient's  rights  might  be  needed  if  city  hospitals  and  health  centers  were 
to  have  their  patient  data  put  into  a  regional  computerized  data  system,  which  was 
then  to  be  linked  to  a  statewide  planning  data  system.    At  first,  the  subcommittee 
worked  its  way  through  a  series  of  key  questions,  such  as  whether  the  entry  of  identi- 
fied patient  information  would  require  informed  consent  in  advance;  who  would  specify 
and  control  access  to  the  data  system;  whether  the  individual  patient  would  have 
access  for  the  purposes  of  correcting  inaccuracies;  and  whether  physicians  would  be 
protected  from  liability  if  the  patient  saw  —  and  resented  —  certain  notations. 

By  1973,  the  Center's  representatives  on  the  subcommittee  "became  concerned 
about  the  compromises  of  confidentiality  inherent  in  such  a  system."    They  proposed  a 
right  by  the  individual  patient  "to  opt  out  of  the  databank,  forego  the  benefits  of 
computerization  —  the  advances  of  science  —  if  one  esteems  privacy  and  confiden- 
tiality of  one's  medical  records  more  highly." 
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In  1974,  to  put  protections  against  "unsafe  systems"  into  law,  the  subcommittee 
proposed  a  two  part  amendment  to  the  New  York  State  Public  Health  Code.     The  first  part 
would  limit  access  to  patient  records  to  persons  directly  associated  with  the  treating 
institutions  or  to  third  party  billers ;  in  other  cases,  access  to  records  would  require 
patient  notarization,  identifying  the  person  permitted  access  and  limiting  the  time 
period  to  which  access  would  apply.     The  second  part  of  the  proposal  would  guarantee 
the  patient's  direct  access  to  his  or  her  own  record.     The  subcommittee's  recommenda- 
tions were  under  consideration  during  the  1975  session  of  the  state  legislature,  and 
the  Center  was  involved  in  pressing  for  their  adoption. 

Observations 

The  use  of  EDP  at  the  King  Center  has  not  been  as  extensive  as  at  Los  Angeles 
County,  or  as  pioneering  as  some  of  the  other  profiles  we  will  be  presenting,  such  as 
the  Kaiser-Permanente  hospitals.     The  Center  is  moving  now  into  a  terminal-based  system 
of  on-line  computing,  and  this  will  probably  lead  it  into  a  more  advanced  stage  of  com- 
puter usage,  especially  as  far  as  patient  profile  data. 

Where  the  King  Center  is  an  outstanding  pioneer  is  in  its  definition  and  appli- 
cation of  patients'  rights,  especially  its  provision  of  such  normally  "middle  class- 
rights"  in  a  setting  of  urban  blight,  grinding  poverty,  and  racial-minority  patients. 
It  has  achieved  this  through  the  support  of  some  dedicated  people  at  Montefiore  Hospital 
but  the  primary  role  has  been  played  by  talented  community  residents  themselves,  fos- 
tered by  OEO  and  HEW  grants  that  have  allowed  the  Center  to  pursue  medical  and  social 
programs  that  would  have  been  impossible  without  such  federal  help.     In  a  sense,  the 
Center  stands  as  one  of  the  few  remaining  monuments  to  the  war-on-poverty  dream  of 
community  institutions. 

But  the  Center's  continuance  is  far  from  assured.     This  is  not  only  because  of 
its  dependence  on  federal  grants  but  also  because  of  national  economic  distress,  the 
withdrawal  of  trained  medical  personnel  from  ghetto  practice,  and  the  danger  of  hard- 
ening of  the  arteries  in  a  middle-aged  social  institution  that  was  an  innovator  in  its 
youth. 

Despite  all  of  these  potential  dangers ,  the  King  Center  demonstrates  that  both 
advanced  technology  and  respect  for  citizen  rights  can  coexist.     The  King  Center  model 
is  there  to  be  used  by  American  society,  if  it  wishes  to. 
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SOURCES 


The  initial  site  visit  in  1974  was  made  by  Richard  Silberberg  and  Jamie  Broder, 
who  did  the  first  profile  draft.     Further  interviews  and  telephone  calls  with  King 
Center  personnel  and  Montef lore  Hospital  staff  were  done  until  early  1 976  by  Helene 
Toiv  and  Alan  V/estin.     The  final  draft  was  written  by  Westin,  with  assistance  from 
Florence  Isbell. 

The  primary  sources  of  published  material  were  the  Annual  Reports  of  the  King 
Center,  down  through  the  last  available  one,  the  Sixth  Report  (1972-73).    Also  of  great 
help  was  the  Center's  handbook,  Training  Community  Health  Workers ,  1 966-1 974 . 

For  interviews,  we  are  grateful  to  Center  Director  Deloris  Smith;  Nurse  Practi- 
tioner B.  Lawson;  Family  Health  Worker  A.  Davila;  Medical  Records  Coordinator  Eugenia 
Joseph;  Health  Advocate  Liery  Wynn;  Administrator  Kathleen  Estrada;  and  Montefiore 
Hospital  Public  Relations  Director  Grace  Urrows. 
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CHAPTER  7.     KAISER -PERMANENTE  MEDICAL  CARE  PROGRAM 


The  Kaiser-Permanente  Medical  Care  Program  is  of  interest  to  our  study  because 
of  three  features  that  are  in  contrast  to  the  health  care  facilities  we  have  treated 
so  far:  ^ 

1.  Its  patients  are  primarily  imionized  workers  or  middle  class  subscribers, 
not  the  urban  poor.     They  pay  for  service,  and  have  alternatives  to  Kaiser  should  they 
feel  that  care  is  inadequate  or  their  "rights"  are  not  being  respected. 

2.  It  is  a  pre-paid  medical  plan  that  is  both  medical  provider  and  insurer. 
This  means  that,  with  a  few  exceptions.  Kaiser  does  not  provide  third  party  payers — 
either  private  insurers  or  government  agencies — with  identified  patient  information. 

3.  It  had  five  years  of  experience  (from  I968  to  1973)  with  a  highly  advanced 
project  on  computerized  patient  records,  and  is  now  pursuing  other  approaches  towaxd 
an  ultimate  hospital  information  system.     Neither  Los  Angeles  County  nor  Martin  Luther 
King  Center  have  yet  automated  the  basic  patient  record,  and  this  makes  the  trials 
and  tribulations  that  Kaiser  underwent  an  important  experience  to  capture. 

Background 

Kaiser-Permanente  is  the  offspring  of  the  Kaiser  industrial  empire  which 
flourished  on  the  West  Coast  before  and  during  World  War  II.     In  order  to  reduce  the 
cost  of  employee  health  care,  Kaiser  set  up  its  own  system  of  hospitals,  clinics  and 
participating  physicians.     At  its  height,  the  Kaiser  program  met  the  medical  needs  of 
100,000  employees. 

When  layoffs  after  the  war  caused  membership  in  the  medical  plan  to  drop  below 
14,000,  a  decision  was  made  to  open  the  plan  to  the  general  public.     Today,  the 
Kaiser-Permanente  program  is  the  largest  group  medical  plan  in  the  country,  a 
six-region  cooperative  system  providing  "total"  medical  care  for  2.6  million  people 
in  California,  Oregon,  Washington,  Hawaii,  Colorado  and  Ohio.     It  has  50  clinics, 
23  hospitals  amd  laboratories,  and  employs  2,595  full  and  part-time  physicians 
throughout  the  various  Permanente  Medical  groups.     Though  there  are  differences  in 
benefits  among  the  various  plans,  most  provide  comprehensive  coverage,  ranging  from 
examinations  and  innoculations  to  long-term  hospital  care.     It  is  non-profit,  under 
the  aegis  of  the  Kaiser  Foundation  Health  Plan. 

When  the  Kaiser  plan  was  first  begun  and  limited  to  its  employees,  it  was 
considered  a  radical  venture  and  aroused  considerable  hostility  from  some  sectors  of 
organized  medicine.     Its  physicians  were  salaried,  and  most  still  are  though  some 
are  now  partners  receiving  percapita  shares.     This  use  of  salaried  doctors  evoked 
from  conservatives  protests  against  "the  corporate  practice  of  medicine."  Coupled 
with  prepayment,  this,  raised  even  more  fervent  protest  about  "socialized  medicine" 
and  "destruction  of  the  doctor-patient  relationship." 

Attitudes  have  changed  in  the  last  thirty  years,  and  there  is  now  broad 
recognition  that  Kaiser-Permanente  provides  some  answers  to  widespread  medical 
problems.*    With  a  salaried  staff,  there  is  no  physician  incentive  to  encourage 


*  See  Sheila  K.  Johnson,  "Health  Maintenace s  It  Works," 
N.Y.  Times  Magazine,  April  28,  197^,  3^. 
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unnecessary  (but  often  profitable)  surgery  and  hospitalization.     Prepayment  enables 
Kaiser-Permanente  to  emphasize  preventive  medicine — catching  health  problems  before 
they  become  costly  in  human  or  economic  terms.     Kaiser-Permanente  members  "spend  less 
than  half  as  many  days  in  the  hospital  as  other  Americans."    Prepayment  also  keeps 
Kaiser-Permanente  premiums  low  -  $600  a  year  for  a  faimily  of  three  or  more,  well 
below  the  average  payment  for  care  in  other  plans  and  programs. 

The  Kaiser  system  has  not  been  without  criticism.     Some  subscribers  complain 
that  there  are  not  enough  physicians,  causing  patients  to  wait  weeks  for  routine 
appointments.     Some  patients  feel  the  doctors  shunt  them  through  their  examinations 
too  quickly  and  impersonally.     One  subscriber  complained  that  he  feels  "like  a  cog 
in  a  machine."  There  are  occasional  complaints,  but  measured  by  the  ultimate  test  of 
consumer  satisfaction — renewal  of  membership  by  2.5  million  persons  in  a  voluntary 
plan  where  there  are  ready  and  varied  alternatives — the  Kaiser-Permainente  program 
obviously  offers  what  a  great  many  individuals  and  families  are  seeking  in  health  care. 

Computerization  at  Kaiser-Permanente 

Kaiser-Permanente  was  a  pioneer  in  "multiphasic  health  screening,"  in  which 
yearly  intensive  examinations  are  offered  to  members  along  with  a  battery  of  tests 
designed  to  identify  health  problems  early.     Starting  in  1950,  the  multiphasic 
screening  was  supported  by  card-punching  and  sorting  equipment,  in  a  manual  record. 
But  the  resulting  records  were  unorganized  and  difficult  to  use.     Patient  folders 
stuffed  with  documents  such  as  lab  results,  surgical  summaries,  doctors'  and  nurses' 
notes,  identification  information,  and  sometimes  even  basic  accounting  data.  In 
most  cases,  the  physician  lacked  time  to  review  the  record  and  was  forced  into 
hurried  extraction  of  those  items  critical  to  the  patient's  current  problem.  In 
addition,  manual  record-keeping  costs  were  very  heavy,  accounting  for  29%  of  the 
hospitals'  operating  costs. 

In  i960.  Kaiser  Medical  Methods  Research  began  a  pilot  study,  funded  peirtly  by 
the  U.S.  Public  Health  Service,  to  see  how  computerization  might  improve  patient 
record  keeping  and  data  communication.     Based  on  that  study,  in  1968,  the  National 
Center  for  Health  Services  Research,  an  HEW  agency,  awarded  Kaiser-Permanente  funds 
to  develop  "a  computer-based  system  that  will  support  the  medical  data  requirements 
of  one  million  health  plan  members,   one  thousand  physicians,  and  a  large  corps  of 
professional  and  para-medical  contributors  to  patient  care."    The  first  step  was  a 
pilot  project  conducted  in  the  San  Francisco  Kaiser-Permanente  facilities,  covering 
130,000  Health  Plan  members. 

Before  going  on  to  describe  how  the  computerized  patient  records  pilot  progrsim 
works,  it  is  important  to  note  that  it  is  only  one  component  in  Kaiser's  record 
keeping  program.     The  other  record-keeping  elements  are: 

1 .  Administrative  and  Financial  Records 

As  in  many  other  medical  institutions ,.  computerization  at  Kaiser  began  in 
the  early  1950's  with  accounting  and  billing.     By  1973.  there  were  "more  than  400 
programs  utilizing  EDP  in  administrative  and  financial  areas.     This  includes 
generating  group  direct  billings,  mapping  address  and  coverage  changes  and  providing 
statistical  profiles."    These  administrative  and  financial  records  are  kept  separate 
from  patient  records  and  stored  centrally. 
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2 .  Manual  Patient  Records 

All  patient  records,  except  those  in  the  pilot  computer  program,  are  kept 
and  stored  manually  in  the  offices  of  participating  physicians  and  within  Kaiser- 
Permanente  health  facilities.     Manual  records  for  patients  in  the  pilot  project 
also  continue  to  be  kept  in  this  way,  since  the  computerized  records  are  in  addition 
to,  not  in  replacement  of,  the  old  records. 

The  pilot  project  system  was  designed  to  make  the  computerized  record  (Patient 
Computer  Medical  Record)  the  fundamental  repository  and  basic  source  of  patient 
medical  information.     Each  computerized  record  was  to  be  "a  continuous  lifetime  record 
COTitaining  all  essential  present  and  future  inpatient  and  outpatient  data,  including 
patient  data  from  any  facility  and  any  location."    As  in  the  manual  record,  the  file 
included  Kaiser-Permanente  medical  record  number.  Social  Security  number  ,  name , 
birthdate,  sex  and  blood  type,  plus  enough  identifying  information  on  family  members 
to  permit  cross-referencing.     The  medical  data  section  of  the  record  included 
historical  information  on  past  illnesses,  observations  by  physiciems,  test  results, 
preliminary  and  firm  diagnoses,  and  reports  on  medical  procedures  ordered  and/or 
performed.     Financial  and  administrative  patient  data  was  stored  separately,  as  with 
the  manual  system.     The  difference,  then,  between  the  msmual  and  computerized  patient 
records  is  not  so  much  what  went  into  them,  but  the  greater  ability  to  extract 
information  from  the  computerized  record,  and  to  make  additional  research  uses  of 
the  patient  data  base. 

For  example,  with  the  computerized  record,  a  physician  in  the  Emergency  Room 
could  receive  a  report  containing  laboratory  data,  multiphasic  data,  amd  a  listing 
of  the  patients  previous  visits.     Or,  the  San  Francisco  outpatient  pharmacy  could 
enter  the  date,  time  and  drug  data  into  each  patient's  computer  medical  record 
through  interactive  typewriter  terminals,  and  the  computer  would  then  print 
medication  labels.     To  refill  prescriptions,  the  old  prescription  number  and  refill 
code  would  be  entered  and  the  entire  label  would  be  printed. 

The  Director  of  the  Medical  Methods  Research  Group  which  operated  the  pilot 
project  is  Dr.  Morris  Collen,  a  pioneer  in  computerized  medical  information  systems. 
He  believes  strongly  that  "the  advent  of  computers  into  the  community  will  undoubtedly 
introduce  a  new  era  of  improved  health  care  delivery."    In  addition  to  the  creation 
of  computerized  patient  medical  records,  the  specific  objectives  of  the  pilot  project 
included  computerization  of  all  laboratory  tests;  development  of  better  communication 
and  reporting  services,  such  as  immediate  (real-time)  reporting  of  essential  medical 
data  via  inter-actlve  terminals  in  the  emergency  room  or  at  the  hospital  or  clinic 
nursing  stations;  testing  of  an  admissions  census  system;  testing  of  acquisitions  of 
physicians  and  nurses  reports  in  the  pediatric  service;  acquisition  of  additional 
selected  medical  and  administrative  data,  such  as  hospitalization  utilization  data. 


*  At  one  time  it  was  believed  that  the  Social  Security  number  would  become  a 
required  universal  identifier,  and  it  was  asked  for  that  reason.     But  Kaiser  no 
longer  thinks  this  and  continues  to  rely  on  its  own  numbering  system. 
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starting  in  I968,  the  pilot  study  applications  were  run  on  an  IBM  360/50,  but 
were  changed  in  1973  to  an  IBM  370/155 •     Telecommunication  terminals  were  located 
at  the  computer  center  and  at  three  Kaiser  facilities  i     Oakland,  Walnut  Creek  and 
San  Francisco.     The  Walnut  Creek  terminals  handled  only  multiphasic  data,  while  the 
Oakland  facility  had  nurse  practitioner  station  and  health  center  terminals  in 
addition  to  a  multiphasic  one.     The  most  advajiced  system,  ajid  the  core  of  the  project, 
was  at  the  San  Frajicisco  Medical  Center)  the  terminals  here  included  admissions, 
emergency  room,  clinical  laboratory,  multiphasic  program,  pharmacies,  outpatient 
encounter  forms,  and  hospital  system.     By  1973f  the  outpatient  system  was  handling  a 
daily  volume  of  2,000  patient  visits,  1,200  clinical  laboratory  specimens,  and 
1,500  prescriptions,  in  addition  to  300  daily  multiphasic  visits.     More  than  400,000 
subscribers  had  their  medical  data  stored  in  the  computer. 

Citizen  Rights  in  the  Kaiser  Pro.ject 
1 .  Confidentiality 

The  Kaiser-Permanente  Service  Agreement  contains  the  following  statement: 
"Information  from  medical-  records  of  Members  and  information  received  by 
Physicians  or  Hospitals  incident  to  the  physician-patient  or  hospital-patient 
relationship  is  kept  confidential,  and,  except  for  use  incident  to  bona 
fide  medical  research  and  education  or  reasonably  necessary  in  connection 
with  the  administration  of  this  Agreement,  is  not  disclosed  without  the 
consent  of  the  member." 

As  noted  at  the  outset,  Kaiser  is  a  pre-paid  plan.  Its  subscribers  do  not  have 
to  file  claims  or  claims  information.     And  since  Kaiser  itself  is  the  insurer,  no 
outside  non-medical  agency  shares  patient  information. 

There  are  some  exceptions. 

Five  percent  of  Kaiser's  revenue  comes  from  patients  who  receive  Medicare  and 
Medicaid,  and  one  percent  comes  from  MediCal  recipients.    Authorization  is  secured 
from  these  patients  to  send  required  information  to  the  appropriate  federal  and  state 
agencies . 

When  a  patient  is  admitted  to  a  Kaiser  Foundation  hospital,  he  or  she  signs  a 
form  which  includes  the  statement:  "The  hospital  is  authorized  to  furnish  from 
patient's  record  requested  information  or  excerpts  to  any  insurer  of  patient." 
Kaiser-Permanente  also  has  a  separate  form  authorizing  them  to  furnish  a  designated 
party  with  "any  and  all  medical  information,  history,  records,  diagnoses,  reports  or 
x-rays  in  your  possession  concerning  the  undersigned." 

These  two  fonns  obviously  authorize  a  broad  range  of  information  sharing, 
and  patients  are  not  told  that  they  have  any  option  to  sign  or  not. 

Recently  an  attorney  who  checked  into  a  Kaiser  Hospital  for  an  abortion  deleted 
the  release-of-inf ormation  part  of  the  consent  form.     She  said  it  was  "coercive  and 
anxiety-producing,  potentially  incriminating  to  patients,  and  from  the  hospital's 
point  of  view,  legally  unnecessary."    When  she  explained  this  objection  to  the 
resident  on  duty,  he  called  a  "medical-legal"  advisor,  who  told  the  patient  that  she 
could  delete  the  paragraph. 
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James  Sexton,  a  Kaiser  administrative  official,  says  that  the  most  frequent 
demajids  on  patient  records  from  secondary  users  come  from  three  sources:  life 
insurance  companies,  attorneys,  and  law  enforcement  agencies.     Insurance  companies 
have  to  obtain  a  release  from  the  patient  and  they  do  not  generally  ask  for 
unauthorized  information.     The  attorneys  sire  usually  representing  patients  in 
malpractice  or  third-party  liability  cases.     As  to  law  enforcement  agencies.  Sexton 
said  that  local  police  usually  do  not  try  to  obtain  information  because  they  know 
Kaiser  personnel  are  reluctant  to  give  it.     However,  if  the  FBI  is  seeking 
information,  Kaiser-Permanente  officials  "like  to  cooperate."    They  will  not  divulge 
any  medical  information,  but  they  will  usually  answer  FBI  questions  as  to  whether 
an  individual  was  visiting  a  Kaiser  facility  at  a  particular  time.     These  occasions 
are  infrequent,  and  in  each  case,  the  facility  administrator  makes  the  decision  about 
what  information  to  release. 

No  medical  information  is  provided  to  employers  unless  the  patient  specifically 
requests  it.     An  employer  can  request  a  back-to-work  slip  from  an  employee's  physician, 
but  no  medical  data  is  included  without  the  patient's  signed  authorization.  Kaiser- 
Permanente  will  not  normally  include  psychiatric  information  when  releasing  a  record; 
their  psychiatrists  are  particularly  concerned  that  there  be  no  leaks  of  confidential 
information. 

In  addition  to  record  sharing  with  the  above  groups,  Kaiser-Permanente,  along 
with  all  California  medical  care  providers,  are  legally  required  to  supply  government 
agencies  with  certain  information.    For  example,  all  infectious,  contagious  or 
communicable  diseases  must  be  reported  to  a  health  officer;  patients  who  suffer  lapses 
of  consciousness  are  reported  to  the  State  Department  of  Motor  Vehicles;  injuries 
inflicted  with  a  deadly  weapon  go  to  a  local  law  enforcement  official;  injuries 
deliberately  inflicted  on  children  under  12  go  to  the  juvenile  probation  department; 
and  physicians  must  maintain  identified  records  on  the  dispensing  of  dajigerous  drugs 
for  at  least  3  years,  and  these  records  are  open  to  inspection  by  authorized  law 
enforcement  officers.     Kaiser-Permanente  must  also  file  certificates  of  death,  live 
birth,  and  fetal  death  where  the  20th  week  of  gestation  has  been  reached.     The  birth 
and  fetal  death  certificates  list  the  father's  occupation,  and  the  birth  certificate 
has  both  parents'  social  security  numbers.    Some  Kaiser  facilities  also  report  the 
identity  of  patients  with  malignant  tumors  to  the  California  Tumor  Registry,  but 
this  is  voluntary. 

Though  such  duties  are  generally  performed,  they  are  not  always  done.  However, 
Kaiser  personnel  could  not  recall  any  physicians  being  harrassed  or  prosecuted  for 
not  meeting  any  of  these  legal  reporting  requirements. 

In  addition  to  these  public  reporting  exceptions,  the  courts  can  subpoena  all 
or  parts  of  the  medical  record.     The  California  Medical  Association  rules  on 
confidentiality,  which  Kaiser  generally  uses  as  a  guide,  includes  the  following 
policy  on  court  demands: 

"The  mere  receipt  of  a  subpoena  does  not  necessarily  justify  disclosure, 
without  further  permission  of  the  patient,  of  private  information.    Since  the  patient 
may  sometimes  be  able  to  assert  the  physician-patient  privilege  notwithstsinding  the 
existence  of  a  subpoena,  the  hospital  should,  whenever  possible,  alert  the  patient 
of  the  subpoena  and  of  the  time  and  place  of  hearing  (unless  the  patient  is  a  peirty 
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to  the  action  and  has  therefore  already  received  notice)  so  that  he  may  make  timely 
objection  to  the  disclosure." 

However,  in  practice,  Kaiser  does  not  follow  a  policy  of  notifying  patients  in 
advemce  of  subpoenas,  and  nothing  in  the  subscriber's  agreement  warns  patients  that 
their  records  may  be  given  to  various  government  agencies  under  compulsory  reporting 
requirements,  or  subpoenaed  by  a  court. 

The  above  policies  as  to  confidentiality  and  disclosure  apply  to  all  hospital 
records,  whether  manual  or  computerized.     When  the  pilot  project  was  started,  Kaiser 
adopted  a  rule  that  "each  Patient  Computerized  Medical  Record  in  the  computer  center 
is  subject  to  the  same  regulations  governing  release,  privacy,  and  confidentiality 
as  is  a  record  in  the  hospital  medical  chart  room."    In  addition,  some  special 
regulations  were  adopted  by  the  Hospital  Records  Committee  to  safeguard  computerized 
records . 

All  terminals  were  opened  and  closed  by  action  of  the  computer  operator  only. 
The  emergency  room  terminal, being  the  most  vulnerable,  was  placed  in  a  restricted 
area  and  the  terminal  operator  there  had  to  know  a  valid  5-digit  number  to  operate  it. 
Other  terminals  required  the  use  of  a  plastic  card,  and  a  comprehensive  card-and-key 
system  was  contemplated  for  the  future.    Each  terminal  contained  only  the  data 
prescribed  by  the  program  controlling  that  terminal.    For  example,  the  typewriter 
terminals  in  the  Saji  Francisco  outpatient  pharmacy  were  activated  only  by  the 
computer  operator  in  Oakland  who  stsirted  the  pharmacy  function  program.     "Only  data 
entry  and  data  retrieval  as  programmed  in  the  pharmacy  function  was  available  at 
the  pharmacy  remote  location  terminals,"  and  this  was  via  private  (not  dial-up) 
telephones . 

When  the  emergency  room  terminal  was  in  operation,  the  Medical  Methods  Research 
group  instituted  an  audit  trail.     Each  request  was  logged,  and  the  log  was  published 
every  morning.     Although  designed  as  a  security  measure,  it  was  used  more  as  a  study 
of  utilization  patterns.     Dr.  Collen  says  that  it  became  necessary  to  prevent  data 
being  collected  by  one  research  project  from  being  taken  by  other  groups  before  the 
original  group  could  publish  its  findings. 

The  Hospital  Records  Committee  is  responsible  for  new  policy  decisions  affecting 
computer  confidentiality.     For  example,  initially  when  the  Emergency  Room  received  a 
record  of  patient  visits,  psychiatric  visits  were  included  on  the  list.     Members  of 
the  psychiatric  Department  brought  the  issue  to  the  Committee,  protesting  that  this 
data  should  not  be  available  to  non-psychiatrists.     The  Committee  agreed  and  excluded 
this  information  from  the  emergency  room  terminal. 

Manual  records  continue  to  be  stored  in  central  record  rooms  under  the 
supervision  of  a  medical  record  administrator.     These  are  filed  by  the  patient's 
medical  record  number  and  must  be  signed  out  under  the  responsibility  of  a  physician. 
Psychiatric  records  are  stored  separately  and  special  permission  is  required  for 
their  use.     When  the  patient  is  in  the  hospital,  the  patient  record  is  moved  to  the 
appropriate  ward,  where  it  is  stored  in  restricted  files  at  the  nursing  station. 

Local  civil  liberties  groups  interviewed  in  the  Bay  Area  feel  that  Kaiser- 
Permanente  is  conscientious  about  the  privacy  of  patient  medical  records.     They  have 
heard  of  no  incidents  involving  Kaiser. 
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2 .  Patient  Access 

Under  California  law,  the  patient's  record  is  the  property  of  the  physician  or 
hospital,  and  the  patient  has  no  legal  right  to  see  it.  But  the  patient's  attorney, 
with  written  authorization  from  the  patient,  must  he  given  the  record  for  inspection 
and  copying.  Previously,  this  right  applied  only  after  the  filing  of  a  legal  action, 
but  that  provision  was  amended  and  now  he  may  have  access  before  an  action  is  filed. 
Indeed,  there  is  nothing  in  the  statute  that  prevents  an  attorney  from  access  to  his 
client's  record  even  when  no  legal  action  is  contemplated. 

A  patient  who  sought  to  see  a  letter  he  had  requested  his  physician  to  write 
was  told  by  Kaiser-Permanente  that  it  would  release  the  letter  only  to  his  attorney, 
upon  request  of  the  attorney  and  with  a  release  signed  by  the  patient.     The  release 
form  contained  a  mandatory  indemnity  agreement  under  which  if  the  patient  sued  a 
third  party,  and  recovered,  he  must  reimburse  Kaiser  for  the  cost  of  his  care. 

When  an  attorney  does  gain  access  to  a  record,  a  monitor  is  always  present  while 
the  attorney  copies  it.     Mr.  Sexton  stated  that  Kaiser  often  tries  to  provide  only 
the  portion  of  the  record  they  consider  relevant,  but  if  challenged,  he  feels  they 
must  supply  the  patient's  entire  record.     He  remarked  that  theoretically,  a  patient 
acting  as  his  or  her  own  attorney  could  gain  access  to  the  record,  but  he  did  not 
think  this  had  ever  occurred. 

Patients  are  also  entitled  to  information  from  the  record  when  they  need  it 
to  make  a  decision  about  future  treatment.     The  California  Supreme  Court  found  that  a 
physician  "has  a  duty  of  reasonable  disclosure  of  the  available  choices  with  respect 
to  proposed  therapy  and  of  the  dangers  inherently  and  potentially  involved  in  each." 

Most  physicians  and  medical  administrators  ajre  not  enthusiastic  about  patient 
access  to  records,  and  the  staff  at  Kaiser-Permanente  adheres  to  the  accepted 
professional  view.     Mr.  Sexton  says  that  Kaiser-Permanente  does  not  allow  patients 
access  "principally  because  it's  a  nuisance."    Patients  don't  understand  the  record, 
he  believes,  and  the  physicians  then  have  to  interpret  it,  which  they  "don't  have 
time"  to  do.     In  addition,  "unnecessary  questions  are  raised  in  the  patient's  mind." 
Sexton  added  that  Kaiser  is  "particularly  circumspect  about  giving  out  medical 
information"  because  their  great  size  and  visibility  make  them  vulnerable  to 
malpractice  suits. 

Kaiser-Permanente  patients  have  seldom  asked  to  see  their  own  records}  this 
occurs  perhaps  once  every  six  months.     The  "patients'  assistance"  personnel  Kaiser 
has  in  each  facility  recently  circulated  a  form  asking  patients  to  list  their 
complaints,  to  see  which  ones  arise  most  often.     No  complaints  about  lack  of  access 
were  listed.     Interviews  that  this  project  conducted  with  a  small  group  of  Kaiser 
subscribers  confirmed  this  situation;  none  of  them  had  ever  requested  access  to  their 
records,  though  all  were  under  the  mistaken  impression  that  if  they  did  ask  to  see 
them,  permission  would  be  granted. 
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Termination  of  the  Kaiser  Project  -  and  Future  Prospects 

At  the  height  of  its  use,  in  1973.  "the  HEW  grant  for  the  pilot  project  (which 
accounted  for  half  its  funding)  was  terminated,  to  the  surprise  and  dismay  of  Kaiser 
officials  and  many  computer  experts  throughout  the  country. 

Because  the  Kaiser  Foundation  Health  Plan,  which  had  put  up  the  other  half  of 
the  money,  was  not  able  to  absorb  the  extra  costs,  much  of  the  system  had  to  be 
dismantled.     Some  of  it  has  been  preserved  on  several  minicomputer  systems  for 
discrete  functions;      automation  of  laboratory  tests  is  continuing  in  a  limited  way 
by  funding  the  Sainta  Clara  facility  with  a  $350,000  laboratory  project  and  the 
pharmacy  system  has  been  given  funds  by  the  Kaiser  Family  Foundation.     But  the  on-line 
computerized  records,  reports  to  the  emergency  room,  ajid  delivery  of  records  via 
terminal  to  the  facilities  have  been  ended.     Dr.  Collen  hopes  that  sometime  in  the 
future  the  separate  systems  that  are  in  operation  may  be  linked  together,  and  they 
have  received  a  grant  to  study  the  requirements  of  each  mini-system  and  the  criteria 
to  connect  them. 

There  are  varying  opinions  as  to  why  HEVi/  funds  were  cut  off.     Dr.  Morris  E. 
Collen,  Director  of  Medical  Methods  Research,  believes  it  was  primarily  "a  question 
of  economics."    He  also  noted  that  computer  technology  is  not  a  current  priority  in 
the  medical  field  in  this  country,  and  expressed  the  opinion  that  the  present  climate 
for  research  and  development  in  computer  operations  in  hospitals  "is  the  worst  in  the 
past  ten  years."    In  addition,  the  difficult  financial  climate  was  complicated  by 
the  Nixon  Administration's  impoundment  of  health  appropriation  funds.     This  created  a 
situation  in  which  the  question  was  not  whether  cuts  would  be  made,  but  only  where 
they  would  be  made. 

Several  other  computer  scientists  in  the  health  services  field  explain  the 
cut-off  with  additional  reasons.     Though  its  multiphasic  screening  program  is  seen 
by  some  medical  specialists  as  a  highly-valuable  system  whose  benefits  would  take  a 
decade  to  measure  objectively,  critics  say  that  Kaiser  failed  to  offer  convincing 
documentation  that  its  multiphasic  screening  program  was  reducing  illness  among 
Kaiser-Permanente  patients.     The  system  proposal  also  promised  a  more  advanced  and 
more  highly  implemented  patient  data  base  system  than  Kaiser-Permanente  was  able  to 
deliver,  and  reviewers  may  have  felt  the  project  should  have  accomplished  more  than 
it  had  at  the  time  the  grant  was  dropped.     Supporters  of  the  Kaiser  project  saw  HEW's 
action  as  representing  an  insufficient  appreciation  of  how  much  time-and  money-it 
takes  to  innovate  in  hospital  computerization  beyond  the  well-established 
administrative  and  laboratory  applications. 

One  aspect  of  the  Kaiser  patient  record  project  that  did  not  draw  criticism  was 
its  policies  and  procedures  for  insuring  confidentiality  and  security  of  patient  data 
in  the  system.     In  fact,  the  protections  developed  by  Kaiser  have  been  adopted  by 
other  advanced  hospital  projects.     On  the  other  hand,  Kaiser's  policies  as  to  informed 
consent  and  patient  access  to  his/her  own  record  were  not  affected  by  computerization; 
these  remain  matters  of  medical  and  social  policy  on  which  Kaiser^  policies  reflect 
the  mainstream  of  current  medical  opinion. 
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Observations 

Informed  opinions  differ  as  to  why  the  Kaiser  project  did  not  accomplish  as 
much  as  its  sponsors  had  thought  they  could.     There  were  problems  with  hardware  and 
software,  resistance  from  some  medical  staff,  and  fixnding  delays  and  uncertainties 
that  derailed  schedules.     But  a  recent  paper  by  two  experts  working  in  Kaiser's 
Santa  Clara  project,  Robert  Harrington  and  Con  Korenoff ,   suggests  that  "the  current 
barrier  in  medical  information  systems  is  conceptual  rather  than  technical."*  i'inancial 
applications  were  adopted  by  hospitals  from  the  industrial  models,  and  laboratory 
applications  from  the  processing  of  large  amounts  of  numerically  coded  data.  But 
the  patient  record  application,  they  note,  poses  the  problem  of  documenting  how 
medical  professionals  actually  practice,  and  organizing  a  mixture  of  facts, 
observations,  and  speculations  into  a  record  that  physicians  will  need — and  use —  at 
a  future  date.     There  are  presently  no  clear  conceptions  about  how  to  do  that. 

Their  comment  underscores  the  fact  that  even  at  Kaiser — where  majiy  of  the 
physician  roles  and  rewards  ajre  more  preventive-health  oriented  and  less 
individualistic  than  in  most  hospitals — the  question  of  exactly  what  medical 
professionals  now  do,  and  what  they  would  be  willing  to  do  in  the  future,  is  at  the 
core  of  any  effort  to  extend  computer  use  into  direct  patient  care.     Dr.  Lawrence 
Weed  has  noted  that  computerization  is  threatening  to  doctors  because  they  have 
traditionally  been  paid  for  using  their  memories,  and  a  computerized  system 
institutes  "a  different  set  of  rewards,  and  requires  sharing  of  power  with  other 
health  professionals."      In  addition,  a  computer  system  introduces  a  discipline  that 
many  doctors  and  nurses  do  not  want  to  accept,  and  against  which  they  caji  always 
invoke  the  argument  that  "attending  the  patient  comes  first." 

Thus  the  Kaiser  experience  shows  that  we  are  barely  ready  to  start  applying 
"central  data  base"  concepts  to  the  hospitals.     American  society  is  reconsidering 
how  health  care  should  be  organized  today,    whether  for  a  subscriber  group,  regional 
population,  or  as  a  national  "system".     Given  the  mixture  of  personnel  facilities,  and 
technological  resources  available  for  the  effort,  it  is  not  yet  clear  how  patient 
information  can  best  be  collected,  stored,  and  used  in  support  of  the  total  health- 
care system.     In  terms  of  citizen  rights  issues,  this  means  that  if  we  are  ready  to 
do  so,  there  is  still  time  to  pay  attention  to  citizen  rights  concerns  at  the  blue- 
print stage  of  hospital  information  systems,  rather  than  to  have  to  rush  into  action 
later,  as  an  afterthought. 


*  "A  New  Look  at  Ambulatory  Health  Information  Systems," 

Information  Technology  for  Public  Services  Engineering  Foundation  Conferences, 
Sept.  15-20,  1975i  Asilomar,  California. 


**Comment  at  NBS  Conference  reviewing  this  report, 
September  l6,  1975. 
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SOURCES 


Part  of  this  profile  is  based  on  a  site  visit  made  by  the  Project  on  Computer 
Databajiks  of  the  National  Academy  of  Sciences  to  Kaiser-Permanente  in  San  Francisco 
and  Oakland  in  1971 »  and  written  up  in  Alan  F.  Westin  and  Michael  A.  Baker, 
Databanks  in  a  Free  Society  (N.Y.:  Quadrangle,  197?),  205-214.  A  return  site  visit 
for  this  project  was  made  by  Alan  Westin  and  Helena  Toiv  in  the  summer  of  1974,  and 
contacts  to  up-date  the  profile  were  maintained  through  Januairy  of  1976. 

The  Kaiser  project  has  generated  a  large  literature.     The  most  useful  items 
for  our  purposes  were s  Morris  F.  Collen  (editor),  Hospital  Computer  Systems  (N.Y.: 
John  Wiley,  197^);  Douglass  A.  Williams,   "Kaiser-Permemente Information  Systems; 
•  A  Review  and  Evaluation,"  in  Russell  C.  Koza  (editor).  Health  Information  Systems 
Evaluation  (Boulder,  Colo. s  Colorado  Associated  University  Press,  1974),  283-2995 
Lou  S.  Davis,   "A  System  Approach  to  Medical  Information,"    Methods  of  Information  in 
Medicine ,  January,   1973;  J.F.  Terdiman,  E.E.  Van  Brunt,  Lou  S.  Davis,  and  M.F.  Collen, 
"A  Pilot  Computer  System  for  Health  Care  Delivery  to  a  Community,"  Medinfo  74. 
Preliminary  Proceedings,  477;  and  Gerald  A,  Giebink  and  Leonard  L.  Hurst,  Computer 
Projects  in  Health  Care  (Ann  Arbor,  Mich. t  Health  Administration  Press,  1975) , 168-174. 

For  personal  interviews,  we  are  grateful  tot  Dr.  Morris  F.  Collen;  Dr.  Joseph  F. 
Terdiman;  Mr.  Lou  S.  Davis;  Mr.  James  Sexton;  Mr. James  Lane;  and  staff  members  of  the 
Northern  California  chapter  of  the  American  Civil  Liberties  Union. 
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CHAPTER  8.    THE  U.S.  INDIAN  HEALTH  SERVICE 


The  approximately  850,000  Indians  in  the  United.  States  are  part  of  American 
society,  but  not  quite.     The  majority  of  them  live  on  reservations  as  wards  of  the  fed- 
eral government,  under  a  complex  mixture  of  federal  and  tribal  law.     Indians  are  at  the 
bottom  of  the  nation's  economic  ladder,  with  average  yearly  incomes  only  half  that  of 
the  white  population,  and  without  the  upward  mobility  that  other  racial  minorities  have 
begun  to  achieve.     In  terms  of  health,  Indians  are  far  worse  off  than  whites  and  blacks 
despite  dedicated  efforts  by  personnel  of  the  Indian  Health  Service,  facilities  and 
services  of  IHS  are  so  bad  that  they  have  been  called,  without  much  hyberbole,  "an 
American  travesty." 

Because  Indian  health  is  a  responsibility  of  the  federal  government,  growing  out 
of  earlier  treaty  guarantees ,  the  Indian  Health  Service  has  had  a  chance  to  bring  ad- 
vanced computer  and  communications  technology  to  bear  on  these  problems;  the  Papago 
Indians'  computer  project  we  will  examine  is  regarded  by  many  as  one  of  the  most  ad- 
vanced problem-oriented  record  systems  in  existence  today.     What  effect  it  has  had  on 
the  quality  of  health  care  in  its  area  and  its  chances  for  increased  use  throughout  IHS 
are  issues  we  will  be  considering  here.    We  will  also  be  looking  at  citizen  rights  is- 
sues in  terms  of  some  different  conceptions  of  privacy  among  Indians  than  those  held  by 
the  rest  of  the  American  population. 

Indian  Health  Problems 

The  1970  Census  reports  that  there  are  827,000  American  Indieins,  including  Alas- 
ka Natives,  Eskimos  and  Aleuts.     The  health  statistics  below  come  from  studies  of  the 
500,000  Indians  living  on  reservations.     The  Indian  Health  Service  (THS)  says  that  it 
has  little  information  about  the  health  conditions  of  the  remaining  Indians  who  live 
off-reservation,  since  it  is  only  very  recently  thai;  the  Service  has  begun  to  provide 
Indian  health  care  centers  in  urban  areas.    Because  of  the  continuous  shifting  of  In- 
dians from  cities  to  reservations  and  back  again  as  employment  opportunities  increase 
and  decrease,  and  as  culture  conflict  creates  pressures  on  Indians  to  accept  or  reject 
reservation  life,  IHS  believes  that  the  health  situation  of  on  and  off- reservation  In- 
dians is  very  similar.     It  is  a  grim  picture. 

The  Indian  death  rate  from  tuberculosis  is  almost  five  times  higher  than  in  the 
rest  of  the  population;  from  intestinal  diseases  (gastritis,  colitis,  etc.)  almost 
four  times  greater;  from  influenza  and  pneumonia  about  twice  as  high;  from  post  neo- 
natal diseases  (infants  one  month  to  one  year  old)  more  than  four  times  as  high.  The 
accident  death  rate  is  more  than  three  times  as  high,  of  which  a  major  ingredient  is 
motor  vehicle  accidents  thought  to  be  associated  with  alcoholism.     In  this  connection, 
Indian  deaths  from  cirrhosis  of  the  liver  are  more  than  two  and  a  half  times  higher 
than  the  rest  of  the  population. 

The  over-all  age-adjusted  death  rate  for  Indians  is  AOfo  higher  than  the  rest  of 
the  population,  even  though  significant  decreases  in  deaths  from  certain  diseases  such 
as  tuberculosis,  influenza,  and   pneumonia  have  occurred  in  the  past  twenty  years. 
While  there  has  also  been  improvement  in  the  rate  of  Indian  infant  deaths,  the  death 
rate  for  new  born  infants  is  still  25.5  per  1,000  births  for  Indians,  compared  with 
16.8  for  whites  and  19.2  for  the  total  population.    Meanwhile,  the  Indiain  morbidity 
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rate  (illnesses)  continues  to  rise  sharply,  especially  for  strep  throat,  influenza  and 
pneumonia,  and  otitis  media  (a  disease  of  the  middle  ear  that  can  cause  deafness). 
Dysentery  is  54  times  more  prevalent  among  Indians  than  non- Indians  and  syphilis  four 
times  more  prevalent.     The  morbidity  rate  is  higher  today  for  Indians  than  for  any 
other  population  group,  and  in  every  single  reported  classification. 

Special  Aspects  Of  Federal  Health  Care  Delivery  To  Indians 

Indians  are  wards  of  the  government,  and  the  federal  government  undertakes  to 
provide  directly  for  their  health  care  through  the  Indian  Health  Service,  an  agency  of 
the  Public  Health  Service,  which  in  turn  is  a  division  of  the  Department  of  Health, 
Education  and  Welfare. 

Placement  of  the  IHS  under  HEW  reflects  the  conflict  between  those  who  would 
integrate  Indians  into  the  American  mainstream,  and  those  who  would  preserve  tribal 
culture.    When  the  Indian  Health  Service  was  established  in  1921  ,  it  was  part  of  the 
Bureau  of  Indian  Affairs  of  the  Department  of  the  Interior.    By  the  1950's  the  health 
of  the  Indians  had  deteriorated  so  alarmingly  that  the  Hoover  Commission  recommended 
that  it  be  put  under  aegis  of  the  Public  Health  Service  because  "Indian  Health  Services 
would  be  under  direct  medical  supervision,  which  was  not  the  case  with  the  Bureau  of 
Indian  Affairs,  where  the  supervision  lay  with  agency  superintendents  amd  others  who 
were  not  medical  professionals..." 

The  transfer  to  HEW  was  made  in  1955.    Despite  Congressional  leanings  toward 
termination  of  special  Indian  programs,  IHS  has  grown  rapidly  since  then — from  a  staff 
of  2,900  and  a  budget  of  $34.5  million  to  a  present  staff  of  7,400  and  a  budget  of  $200 
million. 

The  Indian  Health  Service  program  is  carried  out  through  a  system  of  51  hospi- 
tals (ranging  in  size  from  6  to  276  beds),  77  health  centers,  and  more  than  300  health 
stations  and  satellite  field  clinics.  Additional  medical  and  dental  clinics  are  held  at 
appointed  locations  on  a  regular  daily,  weekly  or  monthly  schedule.     Special  clinics 
are  held  intermittently  as  needed.     IHS  also  conducts  health  examinations,  immuniza- 
tions and  health  educational  programs  in  reservation  schools  run  by  the  Bureau  of  In- 
dian Affairs.     In  addition  to  conventional  health  care,  IHS  operates  several  special 
programs.    Among  them  are  nutrition,  maternal  and  child  care,  family  planning,  and  sani- 
tation. 

However,  measured  against  other  health  care  provided  directly  by  the  federal 
government,  in  Veterans  hospitals  for  example,  or  against  programs  funded  by  the  fed- 
eral government,  or  against  private  medical  care,  the  staffing  and  facilities  in  the 
Indian  Health  Service  are  woefully  inadequate.    A  study  conducted  by  the  Senate  Perma- 
nent Subcommittee  on  Investigations  in  1974  revealed  that  of  51  hospitals  maintained  by 
IHS,  29  cannot  meet  the  certification  standards  of  the  Joint  Commission  on  Accredita- 
tion.   By  contrast,  the  171  hospitals  run  by  the  Veterans  Adminstration  are  all  accred- 
ited.    Thirty-five  of  the  Indian  hospitals  do  not  meet  fire  emd  building  code  regula- 
tions. 

The  Senate  Subcommittee  found  Indian  Health  Service  workers  to  be  "an  extraor- 
dinary group  of  deeply  committed,  hard-working  people... We  found  them  providing  care 
in  crumbling,  ill-equipped  federally  owned  buildings.     We  found  doctors  working  80 
hours  a  week.    We  learned  of  a  nurse  who  collapsed  from  fatigue  and  heat  during  patient 
childbirth  in  an  unventilated  delivery  room.    We  found  staff  shortages  so  severe  that 
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entire  wings  of  hospitals  had  to  be  closed." 

The  Senate  investigators  reported  that  in  one  hospital  there  was  a  "backlog  of 
1 ,500  surgeries  needed  to  repair  the  damaged  eardrums  of  children  suffering  from  otitis 
media... some  Navaho  have  been  waiting  ten  years  for  surgery."  One  IHS  doctor  told  the 
investigators:  "We  see  people  die  of  treatable,  curable  diseases.  We  see  people  die  of 
diarrhea,  diabetes,  infections,  rheumatic  heart  disease,  typhoid  fever,  diphtheria... 
These  would  not  be  tolerated  anywhere  else  in  the  United  States.  Here  it  is  a  way  of 
life." 

In  addition  to  understaffing,  there  is  the  separate  and  chronic  problem  of  high 
staff  turnover.    During  the  Vietnam  war,  the  IHS  was  staffed  largely  by  doctors  who  pre- 
ferred the  Health  Service  to  the  draft.     They  would  serve  the  required  two  years  and 
then  leave.     IHS  foresaw  an  even  higher  turnover  with  the  end  of  the  draft. 

The  high  turnover  of  doctors  and  other  professionals,  and  the  lack  of  training, 
fosters  a  lack  of  uniform  procedures  and  record  keeping.  It  also  means  that  there  is 
not  the  time  to  develop  good  communications  among  the  various  professionals — social 
workers,  sanitarians,  physicians  and  health  workers — who  deliver  health  care  to  the  In- 
dians . 

Contract  And  Third-Party  Medical  Care 

In  places  where  there  is  no  Indian  Health  Service  facility  or  health  facility, 
the  IHS  contracts  to  pay  for  health  care  given  to  Indians  by  outside  hospitals  and  phy- 
sicians.    It  has  made  such  contracts  with  over  500  private  and  community  hospitals, 
with  20  State  and  local  health  departments,  and  with  1 ,000  physicians,  dentists  and 
other  health  specialists. 

Where  there  is  no  contract  medical  care  available,  Indians  are  theoretically  en- 
titled to  the  same  medical  benefits  as  other  citizens:  participation  in  Medicaid,  and 
other  federal  state  and  local  programs  available  to  low- income  citizens,  including 
treatment  at  public  hospitals.    But  Medicaid  and  other  state-administered  programs  do 
not  consider  themselves  responsible  for  Indian  health  care.     Indians  were  not  calcu- 
lated either  by  HEW  or  the  states  as  among  the  consumers  of  such  services  when  they 
were  first  budgeted,  and  some  states  deliberately  did  not  inform  Indians  that  they  were 
eligible  for  them.    A  law  suit  recently  brought  by  a  group  of  Indians  in  Arizona  has 
forced  belated  notification,  ajid  threats  of  further  suits  may  speed  up  the  process  in 
other  states. 

An  Indian  seeking  treatment  in  a  public  hospital  is  likely  to  be  turned  away 
with  the  excuse  that  IHS  facilities  must  take  responsibility  for  his  or  her  care,  even 
though  there  may  be  no  such  facility  within  hundreds  of  miles.    As  to  Medicare,  IHS 
will  not  pay  for  the  monthly  premiums  out  of  its  contract-medicine  budget.     It  argues 
that  it  can  only  pay  for  care  that  is  actually  given,  and  not  for  premiums  against  the 
possibility  that  care  might  be  needed.     The  same  holds  true  for  private  health  insur- 
ance premiums. 

Indian  Health  Boards 

Most  Indian  Health  Service  Unit  Areas  have  Indian  Health  Boards  composed  of 
tribal  members  who  advise  IHS  on  medical  policy  and  programs.     In  some  areas,  the  Board 
has  been  functioning  for  a  number  of  years ,  and  its  members  have  acquired  some  back- 
ground in  health  problems.     In  others,  the  Boards  are  just  being  created.    Some  health 
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Boards  have  well-defined  functions,  such,  as  evaluation  of  IHS  from  a  consumer  point  of 
view;  handling  individual  consumer  complaints;  monitoring  IHS  contract  programs,  etc. 
Other  Boards  limit  themselves  to  interpreting  IHS  programs  to  the  rest  of  the  Indian 
community. 

Since  the  Health  Boards  do  not  have  officially  defined  functions  and  there  are 
no  mutually  agreed  upon  guidelines,  a  great  deal  depends  not  only  on  the  Board's  per- 
ceptions of  its  role,  but  on  the  IHS  staff's  willingness  to  cooperate  with  the  Board, 
and  its  sensitivity  to  Indian  customs  and  culture.     In  some  Service  Units  and  Area  of- 
fices, there  is  a  warm  feeling  of  trust  and  mutual  cooperation;  in  others,  the  relation- 
ship is  a  pro  forma  affair  with  little  real  inter-change;  in  still  others,  there  is  out- 
right hostility. 

Problems  Of  Distance  And  Mobility 

The  Indian  Health  Service  compares  its  health  care  to  that  delivered  in  ghetto 
health  care  programs.     This  is  true  in  the  sense  that  both  encounter  the  diseases  of 
poverty.    But  the  delivery  of  health  care  to  Indieins  is  complicated  by  their  isolation 
— a  relatively  small  population  in  a  vast  area  with  hundreds  of  miles  of  unpaved  roads 
that  are  often  impassable  in  winter.     The  Navaho  reservation,  for  instance,  on  which 
150,000  Indians  live,  is  the  size  of  West  Virginia.     In  some  parts  of  this  reservation, 
the  nearest  hospital  is  80  miles  away,  there  is  no  ambulance  service,  and  many  people 
do  not  have  any  other  form  of  transportation.     In  addition,  many  Indian  tribes  are  mi- 
gratory.    The  constant  shifting  of  population  on  and  off  the  reservation  has  already 
been  noted.    But  Indians  on  the  reservation  also  migrate  within  it,  following  seasonal 
agricultural  and  employment  opportunities.    According  to  V.H.  Chadwick,  Deputy  Director 
of  the  IHS,  many  Indians  "will  visit  not  a  facility,  but  facilities  across  the  geogra- 
phy we  serve... Some  Indian  people. . .have  as  many  as  siz  or  more  Social  Security  numbers 
because  it  is  easier  to  get  a  new  number  than  it  is  to  carry  the  old  one  with  them..." 

Record  Keeping  Problems 

All  of  the  problems  outlined  above  mean  that  the  Service  is  forced  to  practice 
crisis  medicine,  dealing  only  with  the  patient's  chief  complaint  at  the  moment.  Thus, 
if  a  patient  arrives  at  a  health  facility  with  a  cut  on  his  wrist,  the  attending  physi- 
cian will  in  all  likelihood  give  him  a  tetanus  shot,  place  a  bandage  on  the  cut  and 
tell  him  to  come  back  in  a  few  days  if  he  is  not  feeling  better.  The  doctor  will  not 
learn  that  the  patient  is  a  diabetic,  and  is  past  due  for  a  refill  on  his  medications, 
that  he  may  have  a  chronic  heart  condition,  or  that  he  may  have  a  history  of  suicide 
attempts,  which  would  certainly  give  a  special  significance  to  the  cut  on  his  wrist. 

While  there  have  been  attempts  to  begin  multiphasic  screening  programs,  they 
have  been  abandoned  for  lack  of  resources.    According  to  one  IHS  official,  "You  spend 
a  lot  of  time  (with  multiphasic  screening)  seeing  healthy  people  which  would  be  better 
used  dealing  with  illness." 

Although  much  health  data  may  have  been  collected  on  each  patient  by  various 
health  professionals,  the  patient's  record  may  be  scattered  in  the  various  health  faci- 
lities he  or  she  has  visited,  or  it  may  have  been  collected  by  a  social  worker  or  sani- 
tarian and  there  is  no  system  for  making  it  available  to  the  doctor.    No  integrated  set 
of  data  exists  for  each  patient,  and  thus  each  provider  of  health  care  must  treat  the 
patient  with  the  benefit  of  only  that  data  which  he  or  she  alone  has  collected. 
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The  problem  of  maintaining  useful  medical  records  is  further  complicated  by  the 
language  barrier.     In  the  Papago  Indian  tribe,  for  instajice,  65^  of  the  Indians  do  not 
speak  English  and  it  is  difficult  for  staff  members  to  elicit  meaningful  health  infor- 
mation from  the  patients.     This  problem  is  further  exacerbated  by  the  fact  that  with 
the  end  of  the  Vietnam  War,  foreign  doctors  have  largely  replaced  those  doctors  who 
served  in  lieu  of  the  draft.    While  mainy  Indians  who  do  not  speak  English  can  under- 
stand basic  English,  they  find  it  impossible  to  comprehend  the  Phillippine,  East  Indian 
or  Pakistani  doctor,  whose  own  accent  or  mastery  of  English  is  sometimes  shaky. 

Computerization  Of  Records 

All  of  these  considerations  led  the  IHS  to  turn  to  computerization  projects  for 
some  possible  solutions  to  its  record-keeping  problems.     Since  1968,  IHS  has  pursued 
two  approaches  to  computerization.     The  first  of  these  was  the  implementation  of  an 
automated  system  in  Albuquerque,  New  Mexico,  designed  to  assist  management  decision- 
making at  all  levels  of  the  IHS  program.     The  fundamental  output  of  this  system  is 
batch-processed  reports  that  focus  on  over-all  statistics  of  facility  utilization,  in- 
ventory, personnel  and  the  nature  of  services  provided  (immunizations,  dental  services, 
etc.)  to  various  Service  Units  within  the  Indian  Health  Services,     These  off-line  re- 
ports are  used  by  IHS  directors  in  the  field  and  by  IHS  officials  in  Washington  to  help 
in  planning  budgets  and  deployment  of  resources. 

The  second  approach,  on  which  we  will  concentrate,  is  the  Health  Information 
Service  (HIS),  established  in  Tucson.     It  is  a  pilot  project  which  creates  integrated, 
on-line  health  records  on  the  10-12,000  Papago  Indians  in  Southern  Arizona  who  are 
served  by  the  Sells  Service  Unit  of  the  Indian  Health  Service. 

The  Sells  Service  Unit  consists  of  an  integrated  health  care  team  of  physicians, 
public  health  nurses,  sanitarians,  social  workers,  mental  health  workers,  and  includes 
contract  health  services  as  well  as  the  tribal  health  program. 

The  area  that  the  Sells  Unit  serves  is  characteristic  of  the  reservation  condi- 
tions already  described.     The  main  Papago  reservation  is  as  large  as  the  State  of  Con- 
necticut, with  only  6,000  people  living  on  it  in  fifty  small,  scattered  villages,  with 
few  telephones  and  fewer  roads.    An  additional  five  to  seven  thousand  people  live  near 
the  reservation  or  on  the  nearby  San  Xavier  reservation.     The  Sells  Unit  has  a  50-bed 
hospital  located  at  Sells  in  which  outpatient  clinics  are  also  held.     There  is  an  out- 
patient clinic  at  Santa  Rosa  and  another  one  at  San  lavier.     In  addition,  intermittent 
field  clinics  are  held  in  various  locations  such  as  church  buildings  one  or  two  half 
days  a  week.     There  are  major  areas  without  electricity  and  running  water.    About  65?^ 
of  the  houses  are  substandard. 

The  main  function  of  the  computer  is  to  provide  health  professionals  with  a 
complete  medical  summary  on  each  patient,  which  can  be  retrieved  every  time  the  patient 
visits  any  of  the  clinics,  outpatient  stations  or  the  hospital  in  the  Sells  Unit. 
Health  professionals  are  given  an  encounter  form  on  which  to  write  down  patient  infor- 
mation.    This  information  is  fed  into  the  computer  and  can  be  retrieved  instantly  any 
time  the  patient  visits  any  facility  again.     The  filling  out  of  the  encounter  form  it- 
self has  assisted  in  more  systematic  record  keeping.    According  to  Dr.  Rice  Leach,  Di- 
rector of  the  Sells  Unit:  "The  encounter  form  provides  a  terrific  reminder  to  doctors 
to  write  down  what  they  have  been  taught  to  write  down  since  the  first  day  of  medical 
school... We  know  a  lot  of  things  we  are  supposed  to  write  down,  but  if  the  reminder  is 
not  there  in  front  of  you,  it  slips  your  mind." 
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The  on-line  patient  records  are  made  available  through  remote  printer  terminals 
which  are  linked  to  the  computer  hy  telephone  lines  and  are  located  at  each  of  the 
health  facilities.    Pield  personnel  are  equipped  with  portable  terminal  devices  which 
can  operate  over  any  standard  telephone  headset. 

The  medical  summary  provides  the  health  care  team  member  with  a  brief,  multi- 
disciplinary  health  profile  on  each  patient.     The  computer  generates  the  summary  within 
a  few  seconds  of  receiving  a  request  from  one  of  the  remote  terminal  locations.  The 
summary  includes  all  information  collected  during  recent  patient  encounters ,  although 
it  takes  about  five  days  to  enter  new  materials,  so  that  patient  information  gathered 
during  a  visit  within  the  five  days  past  might  not  be  included. 

The  data  in  the  medical  summary  includes:  measurements;  active  and  inactive  pro- 
blems; active  medications;  inpatient,  outpatient  and  field  encounters  with  diagnoses 
and  a  health  status  surveillance  component  which  includes  immunizations,  skin  tests, 
laboratory  tests.  X-rays  and  special  examinations  and  histories.    All  of  these  items 
are  designed  to  permit  the  early  detection  of  treatable  health  problems;  to  assist  in 
the  identification  of  individuals  who  are  susceptible  to  specific  health  problems ;  and 
to  provide  the  foundation  for  an  improved  patient  follow-up  system. 

The  most  important  feature  of  the  medical  summary  is  its  problem  orientation. 
The  problem  list  is  included  as  part  of  the  medical  summary  and  made  available  to  pro- 
viders of  health  care.     The  problems  included  may  be  medical,  emotional,  social,  envi- 
ronmental or  educational.     The  list  allows  members  of  the  health  care  team  to  treat 
each  patient  in  the  context  of  all  of  his  or  her  health-related  problems,  rather  than 
treating  just  the  current  problem.    Health  team  members  make  additions,  deletions  and 
modifications  to  the  problem  list  by  completing  standard  data  collection  forms.  The 
data  stored  for  each  problem  includes  a  system  assigned  problem  number,  problem  code, 
problem  narrative,  dates  of  entry  and  change  of  status,  the  facility  at  which  the  pro- 
blem was  entered  and  identification  of  the  health  professional  entering  each  problem. 

Included  in  the  medical  summary,  and  available  at  each  encounter  with  the  pa- 
tient, is  an  up-to-date  list  of  all  procedures  and  tests  that  are  past  due  or  are  sched- 
uled within  the  next  twelve  months.     This  permits  the  physician  to  take  advantage  of  a 
complaint  visit  to  perform  much-needed  preventive  maintenance. 

The  computer  can  provide  access  to  all  data  of  a  given  type  (e.g.  all  diagnoses, 
medications  or  operations)  for  a  given  patient.     The  response  time  for  such  retrievals 
is  generally  between  fifteen  and  thirty  seconds. 

Special  retrievals  provide  other,  more  complex  kinds  of  information.     The  TB 
contact  status  report,  for  example,  provides  a  listing  of  all  identified  contacts  of 
an  active  TB  patient,  and  for  each,  the  date  and  results  of  the  contact's  last  skin 
test,  date  and  results  of  the  latest  chest  X-ray  and  current  prophylactic  medication 
status. 

In  addition  to  on-line  retrieval  of  individual  medical  records,  the  Tucson 
Health  Information  System  is  able  to  retrieve  data  for  management  and  planning,  for 
epidemiology  and  research.     It  can  respond  to  a  request  like:  "How  many  cases  of  these 
six  diseases  have  been  diagnosed  among  the  residents  of  any  of  these  eight  villages, 
but  I  want  only  diagnoses  made  between  April  and  September  of  1 970  for  female  children 
between  the  ages  of  eight  and  twelve." 
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These  off-line  records  are  printed  on  high  speed  equipment  at  the  computer  cen- 
ter and  delivered  to  the  consumer  by  courier.    Among  the  scores  of  reports  generated  in 
this  way  are  the  following:  weekly  listings  of  scheduled  encounters  for  each  physician 
and  public  health  nurse;  weekly  listings  for  each  public  health  nurse  of  all  patients 
who  have  had  recent  clinic  visits  in  each  Public  Health  Hurse  area;  monthly  reports  for 
sainitarians  of  the  incidence  of  infections  and  parasitic  diseases  in  a  designated  com- 
munity; various  population  summaries  by  district,  community  age  group,  sex,  etc.;  in- 
cidence of  disease  reports;  facility  utilization  reports  by  communities,  age  groups  and 
time  periods;  reports  of  all  children  whose  height,  weight,  or  head  circumference  meas- 
urements exceed  specified  percentile  values  from  standard  curves;  special  reports  on 
accidents,  family  planning  visits,  patients  on  selected  medications,  patient  disposi- 
tion, and  other  miscellaneous  reports. 

In  addition  to  the  above,  the  computer  can  produce  reports  on  a  specific  disease 
with  its  demographic  and  geographic  parameters,  to  support  specific  corrective  programs 
Among  these  have  been  reports  on:  malnutrition  and  iron  deficiency  anemia;  diabetes; 
amebiasis  and  dysentery;  identification  of  deaf  and  blind  children;  identification  of 
attempted  suicides. 

Citizen    Rights  Issues 

The  most  important  right  of  privacy  for  most  Indians  is  the  protection  of  tribal 
(community)  values  and  procedures  from  hostile  surveillance  or  regulation  by  outside 
authorities  —  whether  the  Bureau  of  Indian  Affairs,  local  governments,  or  the  Indian 
Health  Service.     Within  the  tightly-knit  reservation  life,  much  like  older  small-town 
communities  in  colonial  America,  little  individual  privacy  is  asserted  against  fellow 
tribe  members.    But  privacy  is  claimed  strongly  when  outsiders  control  the  education, 
social  behavior,  employment  patterns,  or  health  care  of  Indians.     Conceptions  of  indi- 
vidual privacy  rights  against  government  in  the  Bill  of .  Rights  framework,  are  also  a 
matter  of  concern  to  many  Indians.     Indeed,  not  only  were  such  rights  of  individual 
privacy  included  among  those  rights  sought  by  Indian  leaders  to  be  included  against 
tribal  government  violation  in  the  Indian  Civil  Rights  Act  of  1  968  but  recent  tribal 
constitutions  (such  as  the  Blackfeet  tribe)  specifically  guarantee  the  right  of  per- 
sonal privacy. 

The  result  of  these  special  aspects  of  Indian  culture  is  that  patients  in  the 
IHS  system  have  not  only  individual  concerns  over  matters  of  informed  consent,  improper 
revelation  of  embarrassing  conditions,  and  the  like  but  also  special  concerns  about 
invasion  of  tribal  religious  and  group  mores.     IHS  officials  have  generally  been  sensi- 
tive to  these  concerns ,  but  the  overall  citizen  rights  policies  of  IHS  have  —  until 
recently  —  followed  about  the  same  line  as  other  medical  institutions  in  American  so- 
ciety, governmental  or  private. 

When  the  Health  Information  Service  computerization  program  became  operative  in 
1969,  the  Papago  Indians  did  not  have  an  Indian  Health  Board.     The  Board,  called  the 
Executive  Health  Staff,  was  not  created  until  1972.     Therefore,  the  IHS  staff  dealt  di- 
rectly with  the  Papago  Tribal  Council.     They  conferred  with  the  Council  about  the  com- 
puterization prograim  the  IHS  Office  of  Development  had  in  mind,  explaining  "the  infor- 
mation that  would  be  made  available  and  the  ability  of  the  program  to  maintain  the  con- 
fidentiality of  all  parts  of  it."     "No  matter  how  long  it  took,"  Chadwick  recalled, 
"we  waited  until  the  Indians  fully  comprehended  the  computer  and  then  requested  that  it 
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be  used."    IHS  officials  also  allayed  fears  that  computerized  records  might  dictate  cul- 
turally unacceptable  medical  procedures.    Dr.  Leach  states:  "If  the  computer  tells  me 
that  an  85  year  old  lady  needs  a  very  personal  examination,  and  she  doesn't  want  it, 
she  doesn't  get  it  unless  it  is  a  life- threatening  or  urgent  situation.     We  don't  treat 
the  computer.. We  treat  the  patient." 

In  1972,  when  the  Papago  Tribal  Council  authorized  the  establishment  of  the  Ex- 
ecutive Health  Staff  to  act  on  behalf  of  the  tribe  in  initiating,  coordinating,  admini- 
stering and  implementing  tribal  health  program,  the  IHS  made  its  presentations  about 
health  operations,  computerized  and  manual,  to  this  group. 

According  to  Chadwick,  the  Indians  residing  on  the  Papago  Reservation  know  "all 
there  is  that  it  is  possible  for  them  to  consume"  about  the  Health  Information  System. 
The  Health  Executive  Staff  is  periodically  briefed  by  IHS  officials  in  Tucson  about  the 
system's  operations  and  the  Papagos  are  then  informed  of  the  main  points  by  word  of 
mouth. 

1 .    Patient  Access 

Prior  to  passage  of  the  Federal  Privacy  Act  of  1974,  policies  on  patient  access 
to  medical  records  and  confidentiality  were  governed  by  the  Indian  Health  Manual,  Chap- 
ter 3-Health  Records.        This  90-page  chapter,  distributed  to  all  Service  Units  and 
Area  offices ,  elaborately  detailed  every  aspect  of  medical  record  keeping  in  the  Serv- 
ice.    Its  policy  on  patient  access  was: 

"At  no  time  should  the  patient  or  the  patient's  family  be  permitted  to  review 
the  health  record.     The  patient  should  be  referred  to  the  Service  Unit  Director,  who, 
under  proper  and  appropriate  circumstances ,  may  provide  some  information  to  the 
patient . " 

The  manual  adopts  the  standard  medical  position  that  the  record  is  the  property 
of  the  facility  and  the  IHS. 

What  the  actual  practice  was  is  not  easy  to  determine.     On  the  one  hand,  E.S. 
Rabeau,  a  senior  IHS  official,  reported  that  patients  were  generally  permitted  to  see 
a  copy  of  their  records  "as  a  matter  of  course."    On  the  other  hand,  Mozart  Specter, 
Director  of  the  Office  of  Program  Statistics  of  IHS,  and  Howard  Walderman  of  the  PHS 
General  Counsel's  Office  stated  that  a  patient  who  "pressed  hard  enough"  could  usually 
see  his  or  her  record. 

HEW  regulations  implementing  the  Privacy  Act  provide  that  "Any  individual  may 
request  notification  of  or  access  to  a  medical  record  pertaining  to  him."    The  individ- 
ual is  to  be  given  direct  access  "if  the  responsible  official  determines  that  direct 
access  is  not  likely  to  have  an  adverse  effect  on  the  subject  individual."     If  this  is 
the  determination,  the  medical  record  will  be  sent  to  a  "designated  representative" 
of  the  individual,  "a  physician,  other  health  professional,  or  other  responsible  indi- 
vidual."   Such  person  is  then  allowed  "to  review  the  record"  and  make  the  decision 
whether  to  reveal  "its  contents"  to  the  individual. 

This  new  access  policy  has  been  described  in  posters  displayed  in  IHS  clinics, 
though  access  is  not  mentioned  in  the  "Statement  for  Maintenance  of  Health  Records" 
that  IHS  now  gives  each  patient  to  sign  when  obtaining  information  from  him  or  her. 
(This  statement  will  be  discussed  later  under  "Confidentiality").    As  of  late  1975, 
IHS  officials  report,  most  access  requests  have  been  from  IHS  employees  wishing  to  see 
their  personnel  records.    Reports  were  not  yet  in  as  to  patient  access  requests. 
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There  have  been  complaints  from  some  regional  personnel  that  they  are  not  quali- 
fied to  decide  whether  giving  a  patient  a  record  would  be  detrimental,  and  the  Service 
Unit  Directors  have  been  authorized  to  seek  assistance  from  a  physician  when  necessary. 
Some  problems  have  arisen  because  the  regulations  are  designed  primarily  for  situations 
in  which  the  government  is  not  the  primary  care  provider.  For  example,  there  is  usual- 
ly no  other  physician,  outside  the  IHS  that  can  review  a  patient's  record  if  there  is 
an  access  question. 

Should  errors  be  found  in  patient  records,  IHS  has  taken  the  position  that  it 
will  add  corrections  to  the  record  rather  than  wipe  out  the  old  information  that  is 
there.     The  same  policy  has  been  adopted  by  the  National  Institutes  of  Health. 
2.  Confidentiality 

Prior  to  the  Privacy  Act,  regulations  for  protecting  the  confidentiality  of  pa- 
tient information  and  records  were  listed  in  20  closely  typed  pages  of  the  IHS  Manual's 
Chapter  on  Records.     In  general,  records  could  be  shared  without  patient  consent  among 
IHS  health  professionals  for  the  purpose  of  providing  direct  patient  care;  for  statisti- 
cal research  purposes;  within  the  Public  Health  Service  for  audits  by  the  General  Ac- 
counting Office;  and  in  cases  where  the  U.S.  Attorney  is  engaged  in  defending  the  PHS 
against  a  patient's  claim.     Law  enforcement  agencies  such  as  the  FBI,  and  local  and 
tribal  police  could  be  provided  with  non-confidential  identification  information  (name, 
age,  height,  weight,  color  of  hair,  etc.)  without  patient  consent.    Release  of  confi- 
dential medical  information  to  law  enforcement  agencies  required  signed  patient  author- 
ization. 

Release  of  patient  information  to  contract  physiciajis  and  hospitals,  social  agen- 
cies, insurance  companies,  employers,  attorneys  and  tribal  authorities  required  signed 
patient  authorization.    Release  of  patient  information  for  research  outside  the  Public 
Health  Service  was  not  permitted.    Patient  records  were  released  when  subpoenaed,  with 
the  patient  required  to  be  notified  promptly. 

In  the  past,  IHS  received  quite  a  few  requests  for  patient  information  from 
prospective  employers  and  from  government  agencies.    One  government  request  came  from 
an  assistant  U.S.  Attorney,  who  demanded  that  IHS  officials  provide  him  with  records  of 
all  Indian  women  under  the  age  of  18  who  had  contracted  venereal  disease.    He  wanted  to 
learn  from  these  women  the  identities  of  the  men  who  had  infected  them  and  prosecute 
them  for  statutory  rape.    Despite  his  pressure  on  the  Justice  Department  and  on  HEW, 
the  IHS  refused  his  request.     "We're  not  policemen,  and  we're  not  in  the  tracking  ■ 
business,"  observed  Sidney  Edelman,  Assistant  General  Counsel  of  the  Public  Health 
Service . 

Another  request  came  from  the  U.S.  General  Accounting  Office  (GAO)  a  few  years 
ago.    A  GAO  official  asked  IHS  for  300  medical  histories  of  Indian  women  who  had  been 
treated  for  gonorrhea  along  with  their  names  and  current  addresses.    He  said  that  as 
part  of  an  "environmental  study"  GAO  wanted  to  visit  these  women  and  investigate  water, 
soil,  and  air  conditions  in  their  home  areas.     The  IHS  official  refused,  saying  that 
such  epidemiological  studies  had  nothing  to  do  with  the  auditing  and  fiscal  functions 
Congress  had  assigned  to  GAO,  and  there  was  no  justification  for  supplying  the  case 
histories.     This  set  off  a  series  of  strong  demands  by  higher  and  higher  officials  at 
GAO.    Finally,  the  IHS  official  sat  down  with  a  top  GAO  executive  and  patiently  ex- 
plained the  problem  to  him.     "If  your  wife  had  contracted  gonorrhea  and  had  been  treat- 
ed at  a  federal  hospital,"  he  asked,  "would  you  want  some  federal  official  coming  to 
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the  door  and  announcing  that  he  wajited  to  talk  about  how  she  got  it?"     The  GAO  execu- 
tive saw  the  point,  apologized,  and  the  incident  was  closed. 

Employer  requests  for  medical  information  have  been  referred  back  to  the  patient 
for  specific  release  authorization.     Dr.  Leach  states  that  "when  an  employer  comes  di- 
rectly to  me  for  information  (without  patient  authorization),  I  send  him  home." 

Complaints  about  breaches  of  confidentiality  seem  to  occur  mostly  about  people 
who  have  jobs  that  give  them  access  to  medical  records  who  are  also  residents  of  the 
community.    According  to  a  doctor  at  the  IHS  hospital  serving  the  Apache  tribe:  "This 
is  a  small  town  and  people  tend  to  gossip  about  information  they  see."     The  doctor  con- 
fessed that  he  himself  had  used  patient  medical  records  in  a  non-professional  way.  He 
looked  into  medical  records  when  he  and  his  wife  were  looking  for  a  new  babysitter  be- 
cause they  had  been  "burned"  by  a  babysitter  previously,  and  they  wanted  to  check  on 
the  candidates.    Another  incident  related  by  the  doctor  concerned  someone  who  applied 
for  a  job  at  the  hospital  who  had  been  an  emergency  room  patient.     The  doctor  told  the 
nurse  to  look  in  the  individual's  chart,  and  after  doing  so,  the  nurse  said  "she  didn't 
want  to  hire  him." 

All  of  the  above  incidents  refer  to  the  manual  records  which  are  kept  in  addi- 
tion to  the  computerized  records.    When  the  HIS  system  was  about  to  become  operational, 
Papago  Indian  leaders  expressed  the  fear  that  they  would  be  "put  on  public  display  if 
their  medical  records  were  computerized."    IHS  officials  convinced  the  Indians  that  con- 
fidentiality would  be  better  preserved  under  an  automated  system  than  under  a  manual 
one.     It's  far  safer  to  have  that  sensitive  information  locked  in  a  computer,  than  to 
have  a  record  just  lying  around  for  anyone  to  see,"  an  IHS  official  explained  to  the 
Indian  representatives. 

In  his  1 972  testimony  before  the  HEW  Advisory  Committee  on  Automated  Personal 
Data  Systems,  Dr.  Leach  explained  the  security  measures  taken  to  protect  computerized 
information.     "The  files  are  locked  and  you  need  a  lock  number  to  get  a  medical  summa- 
ry."   The  system  protects  against  an  individual  conducting  a  fishing  expedition  for 
other  information  such  as  "Gee,  I  wonder  if  Cousin  Charlie  has  got  his  problems  listed." 

In  addition,  the  system  is  developing  a  unique  internal  numbering  system  which 
is  seen  as  a  further  aid  to  preserving  confidentiality.     The  numbering  system  was  not 
developed  for  the  primary  purpose  of  insuring  confidentiality,  but  to  deal  with  the 
fact  that  only  2Qffo  of  the  Papagos  have  Social  Security  numbers,  and  mainy  of  these  may 
have  more  than  one.     In  addition,  Papagos,  like  most  Indians,  have  an  Indian  name, 
which  they  do  not  share  with  outsiders,  and  they  may  have  a  variety  of  English  or  Span- 
ish names  which  they  don't  regard  as  important  and  so  sometimes  use  one  or  another  of 
them.     The  computer  will  sort  out  these  various  names  against  the  other  identifying  in- 
formation, to  create  one  record  for  them  all  which  will  be  assigned  a  special  number. 

After  the  federal  Privacy  Act  went  into  effect,  in  September  of  1975,  IHS  gave 
each  patient  a  copy  of  a  "Statement  for  Maintenance  of  Health  Records."    This  explained 
the  statutory  authority  under  which  IHS  maintained  such  records.     Then  the  form  ex- 
plains : 

The  purpose  for  requesting  personal  information  is  to  maintain  an  accu- 
rate record  of  your  medical  care.  This  record  contains  what  you  tell 
the  Health  Care  Provider  is  wrong  with  you  or  how  you  feel.  The  health 
care  providers  write  into  your  record  your  family  and  personal  history 
and  the  results  of  your  physical  examination.  They  also  record  the  re- 
sults of  all  tests,  medications,  treatments,  or  surgical  procedures  you 
receive  in  Indian  Health  Service  facilities. 

183 


With  few  exceptions  Indiaji  Health  Service  personnel  will  not  tell  anyone 
what  is  in  your  record  without  your  written  permission.     Copies  of  your 
record  must  be  released  to  the  State  and  Federal  courts  if  we  are  ordered 
to  do  so.     Information  from  your  record  is  used  to  report  medical  condi- 
tions to  Federal,  State  and  local  agencies,  including  schools,  Tribal 
groups,  and  health  departments  if  they  need  to  know  the  information.  It 
;  may  be  used  to  send  needed  information  if  you  are  referred  outside  the 
Indian  Health  for  additional  care,  to  evaluate  the  care  you  receive,  to 
determine  professional  certification  and  hospital  accreditation,  to  pub- 
lish statistical  reports,  and  to  plan  special  health  programs. 

You  may  choose  not  to  answer  the  questions  if  you  so  desire.  However, 
this  could  have  a  direct  impact  on  the  quality  of  care  you  receive. 
Therefore,  it  is  in  your  best  interest  to  provide  complete  and  correct 
information  so  that  we  will  be  able  to  carry  out  our  responsibility  of 
providing  you  proper  health  care. 

Following  this  is  the  statement  "I  Understand  Why  The  Information  is  Asked  and 
the  Purposes  and  Uses  of  This  Information,"  with  a  place  for  the  patient's  signature 
and  the  date.     The  HIS  computer  has  been  reprogrammed  so  that  it  shows  whether  a  pa- 
tient has  seen  and  signed  the  Privacy  Act  statement. 

Public  health  officials  and  IHS  officials  in  the  field  have  already  spent  con- 
siderable time  and  money  on  implementing  the  1974  Privacy  Act,  including  a  week-long 
training  session  in  Washington  and  local  meetings  attended    by  Indian  groups  and  IHS 
personnel.    Although  IHS  people  feel  that  the  general  idea  of  the  Act  is  a  good  one, 
they  complain  that  not  enough  thought  was  given  to  the  special  complexities  of  medical 
records,  and  that  some  of  the  requirements  are  burdensome  and  confusing. 

The  most  burdensome  requirement,  they  feel,  is  the  disclosure  log  in  which  an 
entry  must  be  made  every  time  patient  information  is  disclosed,  stating  the  date,  nature 
and  purpose  of  the  disclosure,  as  well  as  the  name  and  address  of  the  recipient. 
James  McArthur,  the  Area  Privacy  Coordinator  at  Sells  points  out  that  there  is  a  total 
community  program  that  carries  health  into  the  field.     It  is  common  for  IHS  personnel 
to  consult  with  county  nurses  and  school  health  workers,  and  every  instance  of  this 
sharing  is  required  to  be  noted.     IHS  public  health  nurses  find  the  requirement  burden- 
some too,  and  practices  such  as  reporting  positive  strep  throat  cultures  to  school 
nurses  may  have  to  be  curtailed  unless  additional  personnel  are  hired,  according  to 
Spector  £Lnd  Walderman.     In  addition,  IHS  has  had  difficulty  in  obtaining  from  the 
Social  Security  Administration  information  it  obtained  previously  to  determine  eligi- 
bility of  Indians  for  benefits  under  other  government  programs. 

Future  Of  The  Coapater  In  The  Indian  Health  Service 

The  computerized  HIS  system  is  regarded  with  enthusiasm  throughout  IHS.  Mr. 
Chadwick  calls  it  the  "leading"  computer-based  health  information  of  its  kind.  The 
National  Indian  Board  of  Health  voted  unanimously  to  adopt  HIS  throughout  the  Service. 
Area  directors  throughout  the  system  are  also  favorable  and  the  system  has  won  almost 
universal  acceptance  from  the  physicians  and  patients  among  the  Papagos.     "Doctors  at 
Papago  scream  if  the  computer  is  shut  down  for  24  hours,"  Mr.  Chadwick  observed. 

A  brief  experimental  program  in  Alaska  was  also  enthusiastically  received  by 
officials  there.    Using  a  telecommunications  satellite  that  was  located  there  for  a 
period,  it  was  possible  to  conduct  two-way  television  and  long  distance  specialist 
consultations.     The  retrieval  possibilities  were  not  as  great  as  in  the  Sells  Unit, 
but  officials  in  Alaska  would  like  to  see  the  project  continued.     Throughout  the  IHS, 
officials  are  working  on  computer  possibilities.     In  the  Billings  area,  the  Chief 
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Mediceil  Officer  is  chairing  a  committee  to  determine  their  computer  requirements.  Spe- 
cial HIS  advisory  committees  are  trying  to  develop  special  computerized  high-risk  pro- 
grams (alcoholism,  suicide  attempts,  maternal  and  child  health,  etc)  to  improve  IHS 
ability  to  allocate  resources.    Other  plans  call  for  the  improvement  of  data  entry 
through  the  use  of  video  display  stations  at  field  sites,  and  the  development  of  re- 
porting systems  for  social  service  workers,  mental  health  workers  and  other  paramedi- 
cal groups. 

But  in  spite  of  all  these  dreams ,  it  is  unlikely  that  the  Sells  Unit  will  be  ex- 
panded to  include  more  functions,  or  that  other  units  and  areas  will  be  given  computers. 
An  indication  of  that  unlikelihood  is  in  S,  522,  the  bill  to  ezpand  the  services  and 
facilities  of  the  Indian  Health  Service.     The  bill  proposes  to  expand  the  Service's 
budget  substantially,  including  a  separate  large  construction  budget  to  build  new 
hospitals  and  other  facilities  over  the  next  five  years,  and  making  provision  for  fund- 
ing health  services  to  urbsin  Indians.     There  is  no  budget  item  in  this  bill  for  an  ex- 
panded Health  Information  System.    According  to  Chadwick,  a  HIS  system  throughout  the 
Indian  Health  Sejrvice  would  cost  between  five  and  seven  million  dollars,  and  it  would 
be  "a  hell  of  a  good  investment."    But  Congressional  supporters  of  IHS  did  not  write 
in  funds  for  such  computer  expansion. 

Observations 

The  HIS  experiment  with  the  Papagos  Indians  has  indeed  proved  that  it  can  create 
integrated,  instantly  retrievable  medical  records  that  solve  the  formidable  problems  of 
vast  spaces ,  poor  roads ,  and  telephone  communications ,  the  migratory  nature  of  the  pop- 
ulation and  the  language  barrier.     It  is  a  system  that  has  strong  support  from  physi- 
cians, nurses,  and  managers  using  it.     It  has  also  proved  that  the  system  can  identify 
and  document  the  most  pressing  health  needs  of  the  Indian  people  it  serves. 

But  these  computer  capabilities  merely  emphasize  the  gap  between  society's  abil- 
ity to  record  and  diagnose  its  ailments  and  its  inability  to  treat  them.    Until  the 
Papagos — along  with  the  rest  of  the  Indian  population  in  the  United  States — can  be  as- 
sured of  an  adequate  health  care  delivery  system,  including  hospitals  at  least  on  a 
par  with  those  available  to  the  rest  of  the  population,  adequate  numbers  of  health  care 
personnel,  adequate  funding  to  combat  their  special  health  needs  and  to  improve  sanita- 
tion, nutrition,  housing  and  other  environmental  factors  that  jeopardize  health,  Indian 
health  will  continue  to  be  in  crises.     In  this  crisis,  a  computerized  medical  records 
system  can  only  be  regarded  as  luxury.     If  the  needs  outlined  were  to  be  fulfilled, 
however,  then  the  HIS  system  pioneered  among  the  Papagos  could  serve  as  the  central 
force  for  making  the  delivery  of  medical  care  effective. 

As  far  as  citizen  rights  are  concerned,  IHS  now  has  a  new  set  of  policies  de- 
fined by  the  Federal  Privacy  Act.     There  would  seem  to  be  no  reason  why  the  computer- 
ized system  in  IHS  will  have  any  greater  difficulty  in  complying  than  the  manual  re- 
cord systems.    How  the  new  rules  as  to  confidentiality  and  patient  access  will  work  in 
practice  will  be  examined  in  1 976-77  by  the  federal  Privacy  Protection  Study  Commission 
and  by  Congressional  committees  overseeing  the  operations  of  the  Act.     This  will  pro- 
vide some  important  data  about  the  advantages,  disadvantages,  and  costs  of  the  new 
rights  set  by  the  Federal  Act,  and  how  the  Indian  population  regards  these  measures. 
IHS  officials  interviewed  in  early  1976  said  it  would  be  "several  years  before  all  the 
contingencies  are  clarified."    Some  of  the  most  important  of  these  problems  will  be 
discussed  in  our  final  chapter. 

185 


SOURCES 


A  site  visit  was  made  to  the  Washington  offices  of  the  Indian  Health  Service  in 
July  of  1974  hy  Alan  Westin  and  Richard  Silberberg.    Follow-up  interviews,  including 
telephone  interviews  with  IHS  officials  in  Arizona,  Indian  leaders,  Indian  Rights 
groups,  and  American  Civil  Liberties  Union  affiliates  in  the  Southwestern  area,  were 
conducted  during  1975,  primarily  by  Helene  Toiv.    Additional  interviews  were  held  in 
late  1975  and  early  1976  on  IHS  compliance  with  the  Federal  Privacy  Act.     The  first 
draft  of  the  profile  was  written  by  Silberberg,  then  revised  and  rewritten  for  the 
Final  Report  by  Westin  and  Florence  I shell. 

-The  most  useful  published  sources  for  the  profile  were: 
U.S.  Department  of  Health,  Education  and  Welfare,  The  Indian  Health  Program  of  the 
U.S.  Public  Health  Service,  Washington,  D.C.,  U.S.  Government  Printing  Office  1972; 
U.S.  Department  of  Health  Education  and  Welfare,  Indian  Health  Service  Office  of  Re- 
search and  Development,  Washington,  D.C. ,  U.S.  Government  Printing  Office  1973;  In- 
dian Health  Service  Health  Information  System;  Summary  Briefing,   (mimeo),  Office  of 
Management  Information  Systems,  Tucson,  Arizona,  August  2,  1972;  "Indian  Health  Service 
System,  Tucson,  Arizona,"  in  Gerald  A.  Giebink  and  Leonard  L.  Hurst,  Computer  Projects 
in  Health  Care ,  (Ann  Arbor:  Health  Administration  Press,  1975),  164-168;  Testimony  of 
Indian  Health  Service  Deputy  Director  H.V.  Chadwick  before  Advisory  Committee  on  Auto- 
mated Personal  Data  Systems,  Department  of  Health,  Education  and  Welfare,  August  17, 
1972,  p. 70;  U.S.  Department  of  Health,  Education  and  Welfare,  The  Indian  Health  Serv- 
ice Health  Information  System;  Summary  Description,  January  4,  1972,  Washington,  D.C. 
U.S.  Government  Printing  Office,  1972,  p. 4;  "Indian  Health  Care  Improvement  Act," 
Hearings  before  the  subcommittee  on  Indian  Affairs  of  the  Committee  on  Interior  and 
Insular  Affairs ,  House  of  Representatives,  94th  Cong.,  1st  Sess,,1975;  Health  Care  in 
Alaska  via  Satellite , Martha  C.  Wilson,  M.D.  and  Charles  Brady,  paper  for  AIAA  Confer- 
ence on  Communication  Satellites  for  Health/Education  Applications,  Denver,  Colo.,  July 
21-23,  1975;  Indian  Health  Manual,  Part  3,  Professional  Services,  Chapter  3  (mimeo) 
Indian  Health  Service,  July  12,  1972;  Indian.  Health  Service  Reporting  Systems,  Public 
Health  Service,  Dept.  of  Health,  Education  and  Welfare,  Rockville,  Mo.   (February  7, 
1972,  p.1);  "Hearings  on  Indian  Health  Care,"  Before  the  Permanent  Subcomittee  on 
Investigations,  Committee  on  Government  Operations,  U.S.  Senate,  Sept.  16,  1974. 

For  personal  interviews,  we  are  grateful  to:  H.V.  Chadwick;  E.S.  Rabeau;  Charles 
D.  Brady;  Sidney  Edelman;  Mozart  Spector;  Howard  Walderman;  James  McArthur;  Cecil 
Williams;  David  Smith;  and  James  Purcell. 
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CHAPTER  9.     THE  MULTI -STATE  INFORMATION  SYSTEM 


The  Multi-State  Information  System  (MSIS)   is  an  automated  information  system 
for  mental  patients'  records,  designed  to  serve  both  administrative  and  research 
purposes  for  participating  institutions  throughout  the  U.S.     The  owner  and  manager 
of  the  central  computer,  the  Information  Sciences  Division  of  Rockland  Research 
Institute,  a  state  facility  in  Orangeburg,  New  York,  does  not  deliver  primary  care 
or  pass  on  any  questions  of  eligibility  or  claims  of  patients;  its  role  is  limited  to 
developing  computerized  forms,  administering  the  data  base  and  data  commimications , 
and  sponsoring  research  by  the  Institute's  own  personnel.     In  our  scheme,  it  is 
primarily  a  Zone  3  organization  as  far  as  its  research  function  is  concerned,  but  it 
could  also  be  considered  an  extension  of  the  Zone  1  mental  health  centers  that  use  it, 

and  it  is  precisely  the  hybrid  character  of  MSIS  that  makes  it  important  for  our  study. 

MSIS  is  a  system  that  has  invested  long  deliberation  and  careful  planning  to 
assure  the  confidentiality  of  patient  records.     Paradoxically,  this  system  has  been 
publicly  attacked  for  posing  grave  new  dangers  to  confidentiality.     Part  of  the 
concern  of  both  the  designers  and  the  critics  of  the  system  stems  from  the  especially 
sensitive  nature  of  psychiatric  information  but  part  flows  from  the  fact  that  it  is 
a  new  type  of  individually-identified  patient  record  system  -  a  multi-state  databank 
with  each  state  having  different  statutes,  practices  ajid  perceptions  of  the  degree 
of  confidentiality  required  for  medical  record-keeping. 

Background 

The  genesis  of  MSIS  was  a  demonstration  at  the  Fourth  World  Congress  of 
Psychiatry  in  1966  by  the  Information  Sciences  Division  of  the  Rockland  Research 
Institute  on  the  uses  of  computers  in  psychiatry.     At  the  demonstration,  clinical  data, 
collected  in  checklist  form  on  a  psychiatric  questionnaire,  were  converted  by  computer 
into  readable  narrative  reports.     To  develop  this  idea  of  producing  narratives  by 
computer,  the  U.S.  National  Institute  of  Mental  Health  invited  the  Information  Sciences 
Division  to  apply  for  a  development  grant,  which  it  obtained  in  1967.     This  was  an 
$8  million  grant  for  five  years,  and  it  was  awarded  with  the  understanding  that  MSIS 
was  to  be  a  regional  system. 

By  197^1  six  states — Connecticut,  Massachusetts,  Rhode  Island,  Vermont,  some 
facilities  in  New  York,  and  one  facility  in  New  Jersey,  plus  the  District  of  Columbia — 
were  participating  on-line  in  MSIS,  using  the  central  computer  at  Rockland  Research 
Institute  in  Oremgeburg,  New  York.     Most  MSIS  users  are  state  institutions  or  private 
facilities  relying  on  state  and  federal  money j  these  serve  largely  lower 
socio-economic  patients.     But  there  are  some  private  voluntary  agencies  and  community 
mental  health  centers  in  MSIS  who  have  middle  class  patients,  as  well  as  a  few 
exclusive  psychiatric  clinics  with  affluent  patients. 

In  September,  1975.  MSIS  had  approximately  400,000  patients  on  file,  most 
represented  by  a  single  episode  of  admission,  treatment  and  termination.     About  45,000 
were  involved  in  multiple  episodes.     At  present,  MSIS  is  the  largest  computer-based 
mental  health  information  system  in  the  country. 
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In  1972,  NIMH  funded  a  two-year  renewal  grant  of  $2  million  for  further 
development  of  MSIS.     This  money  supported  the  staff  and  the  central  computer  at 
Rockland,  with  each  participating  state  assuming  a  share  of  the  rest  of  the  operating 
costs.     When  the  federal  grant  ended,  MSIS*  197^-75  operating  budget  of  $550,000 
came  entirely  from  the  participating  states.     The  cost  to  a  participating  institution 
is  $5.00  to  process  each  patient  episode  from  admission  to  termination. 

How  MSIS  Works 

The  information  that  MSIS  computers  is  capable  of  collecting  and  storing  falls 
into  five  categories: 

1.  Demographics     Sex,  birth  date,  address,  marital  status,  ethnic 
group,  religion,  household  composition. 

2.  Administrative:     Legal  status,  physical  location  of  patient  or 
name  of  treating  unit,  prior  psychiatric  service,  source  of 
referral. 

3.  Patient  progress:     Clinical  appraisals  of  patient's  psychiatric 
condition  including  mental  status  examinations,  progress  reports, 
diagnosis,  case  history. 

Treatment:    A  record  of  all  treatment  contacts  and  a  detailed 
record  of  psychotropic  drug  therapy. 
5.  Service  rendered:     Direct  services  rendered,  contacts  made, 

indirect  services  such  as  consultation  and  community  education, 
ancillary  services  such  as  x-ray,  laboratory  tests  and  dental 
treatment . 

While  these  are  the  total  capabilities  of  MSIS,  the  system  was  designed  so  that 
facilities  could  participate  in  accordance  with  their  varying  needs.     Only  two  types 
of_records  are  mandatory.     The  first  is  the  Admission  form,  which  must  be  filled  out 
for  each  patient  episode  stored  in  the  computer.     However,  even  many  of  the  items  or 
this  form  may  be  omitted  at  the  option  of  the  participating  institution?  of  its  37 
items,  only  6  need  to  be  filled  in  to  create  a  patient  record.     The  second  of  the 
mandatory  records  is  the  form  showing  how  the  patient  episode  terminated  (either  a 
Termination  form  or  a  Change  in  Status  form). 

All  other  forms  available  to  MSIS  users  are  optional.     Two  of  these  optional 
forms  of  particular  interest  in  mental  health  administration  are  the  Mental  Status 
Examination  Record,  which  makes  possible  appraisal  of  the  patient's  problems  and  their 
severity;  and  the  Psychiatric  Anamnestic  Record,  designed  to  record  basic  case  history 
data. 

To  enter  patient  records  in  MSIS,  participating  institutions  bring  their 
completed  forms  to  the  nearest  MSIS  terminal.     Some  hospitals  and  mental  health 
centers  have  their  own  terminals;  others  use  terminals  located  in  other  facilities  or 
in  regional  or  state  offices.     Most  data  collected  from  New  York  State  facilities, 
for  example,  is  processed  on  the  computer  of  the  State  Department  of  Mental  Hygiene, 
in  Albany. 

Terminal  communication  with  the  MSIS  computer  is  by  ordinary  dial-up  telephone 
lines.     When  information  is  transmitted  to  the  computer,  it  generates  a  corresponding 
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report  which  is  sent  back  to  the  terminal  and  distributed  by  terminal  personnel  to 
the  appropriate  participating  facility.     When  an  Admission  form  is  submitted,  for 
example,  a  note  reflecting  the  information  on  the  form  is  returned  to  the  facility. 
Many  reports  generated  by  MSIS  are  in  narrative  form  and  substitute  in  part  for 
those  usually  dictated  by  clinicians.     This  work  is  done  by  batch-processing,  not 
on-line,  since  rapid  response  is  not  needed  for  MSIS  activity. 

Clinical  Uses 

To  demonstrate  its  record-keeping  capabilities,  MSIS  has  prepared  a  model  case 
history  for  a  fictitious  patient  named  Mary  Stewart.     The  information  on  Ms.  Stewart 
was  taken  by  clinic  personnel  and  recorded  on  machine-readable  forms,  from  which  the 
computer  produced  15  tabular  and  graphic  summaries  for  her  psychiatric  records.  It 
must  be  kept  in  mind,  that  this  is  an  ideal  representation  of  the  system's  potential i 
few  participating  facilities  use  all  of  the  forms,  especially  the  diagnostic 
suggestion  one,  although  some  may  provide  all  of  the  clinical  techniques  and 
services  illustrated  in  Ms.  Stewart's  case. 

The  Admission  form  establishes  the  patient's  identity,  assignment  to  ward  and 
unit,  demographic  data,  appraisal  of  problems,  previous  psychiatric  service,  and 
source  of  referral.     Ts.  Stewart's  record  shows  that  she  is  a  24-year  old  secretary 
who  lives  with  her  parents.     She  came  to  the  clinic  voluntarily,  apparently  suffering 
from  drug  intoxication.     She  had  previously  received  psychiatric  care  from  a  private 
psychiatrist  and  at  a  mental  health  center.     Among  her  recorded  problems  were 
disturbances  in  her  relations  with  family  and  other  people  and  in  job  performance, 
as  well  as  suicidal  thoughts,  depressed  mood,  social  withdrawal,  delusions, 
hallucinations,  sexual  problems  and  incoherent  speech.     The  diagnosis  was  drug  or 
poison  intoxication  and  the  overall  severity  of  her  condition  was  judged  slight. 

Ms.  Stewart  then  underwent  complete  psychiatric,  psychological  and  social 
evaluation  at  the  clinic.     Basic  case  history  data  was  recorded  on  the  Psychiatric 
Anamnestic  Record  form,  and  a  narrative  report  was  produced  from  this  data  by  the 
computer.    After  verification  of  the  report's  contents,  usually  indicated  by  the 
physician's  signature,  the  narrative  may  be  placed  in  the  patient's  chart.  The 
information  for  Ms.  Stewart's  report  was  obtained  from  a  physician,  the  patient,  and 
a  family  member,  and  its  reliability  rated  as  "good". 

The  onset  of  her  current  condition,  which  developed  gradually  and  has  been 
evident  for  three  months,  was  apparently  associated  with  a  mildly  stressful 
situation  involving  a  drug  reaction  and  family  problems.     The  patient's  mother  has  a 
history  of  a  mild  functional  psychiatric  illness;  her  father  has  a  history  of  a 
severe  functional  illness;  she  has  one  sibling  who  has  been  at  least  mildly  ill.  The 
section  on  personality  traits  reports  that  the  patieni;  is  inhibited,  unable  to  relax, 
emotionally  distant,  stubborn,  suspicious,  and  gets  little  pleasure  out  of  life. 

The  Mental  Status  Examination  Record  includes  detailed  information  about  the 
patient's  appearance,  general  attitude  and  behavior,  mood,  judgment,  potential  for 
suicide  or  violence,  insight  and  attitude  toward  illness,  and  overall  severity  of 
illness . 
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Based  on  the  information  in  these  two  forms,  the  computer  can  produce  a 
suggested  diagnosis.     This,  however,  is  solely  a  tool  for  the  clinician  aind  does  not 
become  a  part  of  the  patient's  record.     For  Nancy  Stewart,  the  computer  gave  two  most 
likely  diagnoses:  schizophrenia,  paranoid  type,  and  drug  dependence,  hallucinogens. 
A  recent  study  at  MSIS  has  shown  a  high  correlation  between  the  computerized 
diagnosis  and  the  doctor's  diagnosis,  but  as  already  noted,  few  MSIS  participants 
use  this  procedure  today. 

During  the  course  of  Nancy  Stewart's  outpatient  therapy,  her  condition 
deteriorated,  and  she  was  transferred  to  inpatient  status.     Her  continued  delusional 
thinking  and  suspiciousness  led  to  the  conclusion  that  she  was  schizophrenics  drug, 
group  and  individual  therapy  were  prescribed  and  monitored. 

Her  progress  was  monitored  on  the  Periodic  Evaluation  Record,  which  noted 
persecutory  delusions,  good  physical  health,  and  her  activities,  which  included 
visitors  and  attending  organized  patient  groups.    After  three  months,  Ms.  Stewart 
had  improved  enough  to  be  returned  to  outpatient  status,  a  fact  recorded  on  a  Change 
in  Status  form.     The  Periodic  Evaluation  Record-Community  Version  showed  that  during 
her  outpatient  therapy  she  was  still  slightly  suspicious  and  uncooperative,  but  that 
her  condition  was  improved. 

Approximately  six  months  after  Nancy  Stewart's  initial  admission,  the  episode 
was  terminated.     Her  Termination  form  recorded  the  final  official  diagnosis  and  stated 
that  no  further  care  was  indicated. 

MSIS  has  also  automated  a  problem-oriented  psychiatric  record  designed  to 
introduce  clarity  into  psychiatric  record-keeping  by  making  the  treatment  rationale 
explicit.     This  was  used  in  Mary  Stewart's  case.     The  hope  is  that  structuring  the 
record  around  a  core  problem  list  and  keying  all  treatment  and  patient  progress  data 
to  problems  will  foster  increased  use  of  the  chart  as  a  communication  medium  and  as  a 
tool  for  utilization  review  and  program  evaluation.     It  is  still  regarded  as 
experimental,  however,  and  is  seldom  used  by  MSIS  par-tic ipants . 

Ms.  Stewart's  fictitious  case  study  illustrates  the  role  that  automation  could 
play  in  every  stage  of  keeping  individual  psychiatric  records.     However  automated 
clinical  records  are  being  used  far  less  frequently  in  MSIS  than  administrative  and 
research  computer  functions.     There  are  several  reasons  for  this.     Doctors,  according 
to  Dr.  Eugene  H.  Laska,  Director  of  the  Information  Sciences  Division,  "are  not 
entirely  enthusiastic  about  record-keeping  in  any  shape,  form  or  fashion,"  and  he 
knows  of  very  few  psychiatrists  who  rely  heavily  on  patient  history  records,  whether 
manual  or  computerized.     Generally,  psychiatrists  are  skeptical  of  conclusions  drawn 
by  an  unknown  author  of  a  patient  history  or  of  a  diagnosis  found  in  the  record. 
They  prefer  to  collect  and  evaluate  the- personal  data  themselves.     An  important 
exception  to  this  is  the  use  of  drug  summary  outputs,  which  enable  a  doctor  to  find 
out  which  drugs  have  been  tried  and  in  what  dosages,  and  whether  or  not  they  have  been 
successful. 

Dr.  Laska  notes,  however,  that  younger  doctors  at  Rockland  Psychiatric  Center 
are  pro-MSIS  because  it  takes  care  of  many  of  their  record-keeping  chores  and  allows 
for  useful  retrievals.     They  are  not  hostile  to  computerized  diagnostic  suggestions, 
and  use  of  the  Mental  Status  Examination  Record  by  doctors  there  is  increasing.  But 
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Dr.  Laska  adds,  he  does  not  really  know  "if  the  outputs  are  being  read." 

At  the  Connecticut  Mental  Health  Center — which  MSIS  officials  suggested  for  a 
field  study  because  it  is  a  heavy  MSIS  user — MSIS  was  planned  only  as  an  administrative 
aid,  and  not  for  clinical  purposes.     The  Connecticut  Mental  Health  Center  at  New  Haven 
is  a  joint  venture  of  the  State  and  Yale  University.     It  is  largely  ain  outpatient 
facility  with  only  45-50  inpatient  beds.     The  Mental  Status  Examination  Record  is  used 
only  for  utilization  reviews  on  the  inpatient  wards.     Clinicians  prefer  to  use  the 
notes  they  dictate  and  that  are  put  into  the  patient's  chart;  they  believe  that  the 
MSIS  forms  are  "not  rich  enough  for  them." 

Research  Uses 

Aside  from  physicians'  instinctive  preference  for  their  own  notes,  and  their 
traditional  dislike  of  record-keeping,  a  less  explicit  element  may  influence  the 
greater  research  and  administrative  use  of  MSIS  capabilities.     Along  with  other  mental 
health  information  systems,  MSIS  was  originally  supported  by  research-granting 
agencies,  as  a  research  tool.     The  grant  receivers  tend  to  be  more  responsive  to  the 
research-granting  agencies  than  to  the  service-providing  agencies. 

The  research  capability  of  MSIS  has  been  impressive.     For  example,  researchers 
have  investigated  drug  data  in  an  effort  to  link  variables  from  an  individual's 
background  to  drug  response.     A  study  using  data  on  9-10,000  patients  at  Rockland 
Psychiatric  Center  examined  the  relationships  among  drug  prescriptions,  diagnoses, 
and  other  variables.     The  study  showed  that  in  many  cases,  the  optimal  drugs  were  not 
being  prescribed. 

A  research  team  directed  by  Dr.  Carole  Siegal,  a  mathematician  at  the 
Information  Sciences  Division,  recently  developed  a  way  of  evaluating  the  effectiveness 
of  community  health  center  procedures.     The  study  showed  that  there  were  differential 
service  patterns  for  various  age,  sex  and  ethnic  groupings,  and  raised  questions  as  to 
the  justifications  for  this. 

Research  and  program  evaluation  activities  using  MSIS  data  are  particularly 
strong  at  the  Connecticut  Mental  Health  Center,  whose  staff  members  include  professors 
or  instructors  at  Yale.     According  to  Michael  Levine,   Chief  of  Statistics  and  Data 
Processing,  many  staff  members  are  engaged  entirely  in  research.     More  than  forty 
papers  published  by  the  staff  of  this  Center  have  been  based  on  or  have  used  MSIS 
data. 

Researchers  at  the  Information  Sciences  Division,  as  a  follow-up  to  studies 
suggesting  that  Reserpine  therapy  for  hyper-tension  is  associated  with  breast  camcer, 
have  started  a  study  of  this  relationship  using  the  prescription  records  of 
Rockland  patients  on  the  MSIS  file.     The  study  is  particularly  relevant  in  a 
psychiatric  center  because  Reserpine  was  routinely  prescribed  as  a  psychotropic 
drug. 

Administrative  Uses 

The  greatest  use  to  which  MSIS  is  put  is  still  for  administrative  records  and 
reports.     To  serve  these  needs,  MSIS  has  two  basic  retrieval  mechanisms.  GALS 
(Generalized  Alphabetic  Listor)  is  a  languag>3  used  to  generate  lists  of  patients  who 
satisfy  criteria  specified  by  a  user;  for  example,  a  list  of  all  male  patients  in 
residence  between  the  ages  of  18  and  25  with  a  diagnosis  of  schizophrenia, paranoid 
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type,     STARGEN   (Statistical  Report  Generator)   is  a  language  used  to  produce 
statistical  cross  tabulations:    For  example,  a  cross  tabulation  of  all  patients  in  a 
particular  facility  eligible  for  Medicaid  by  age,  sex  and  diagnosis. 

Using  these  two  retrieval  systems,  MSIS  has  developed  a  broad  variety  of  lists 
tailored  to  specific  information  needs;     Lists  of  patients  whose  legal  commitments  are 
due  to  expire;  patients  who  are  due  for  physical  examinations  or  other  tests;  patients 
who  are  receiving  more  than  two  psychotropic  medications;  all  patients  in  a  given 
building  under  the  supervision  of  a  par-ticuleir  doctor  with  their  active  drug 
prescriptions.     (The  last  list  is  routinely  used  by  nurses  to  prepare  medication  cup 
cards  and  by  physicisms  to  review  the  current  regimes  of  their  patients.)    At  one 
participating  facility,  this  routine  list  indicated  unusually  large  amounts  of  a 
sleep-inducing  drug  were  being  used.     Checking  revealed  that  one  night  attendant  was 
over-medicating  the  patients  so  that  they  would  not  disturb  him  during  the  night. 

MSIS  allows  participating  facilities  to  comply  easily  with  NIMH  requirements  for 
an  annual  report  on  patients  in  residence.     To  meet  this  need,  MSIS  developed  several 
NIMH  tables,  as  well  as  other  tables  to  be  used  to  satisfy  state  reporting 
requirements. 

As  users  become  aware  of  the  capabilities  for  statistical  reporting,  the 
requests  for  reports  both  increase  and  become  more  diversified.     Today,  about  half  of 
the  total  computer  time  is  spent  on  such  retrievals:     Local  alcoholism  and  other 
clinics  now  get  lists  of  patients  who  fail  to  return  for  follow-up  visits.  Rockland 
County  Community  Mental  Health  Center  periodically  requests  a  list  of  all  patients 
who  showed  suicidal  tendencies  and  who  have  not  been  seen  for  30  days. 

Mental  health  service  does  not  generally  require  on-line  retrieval  of  individual 
records.     As  Dr.  Laska  noted,   "No  one's  upset  if  the  computer  is  down  for  three  hours." 
This  is  because  most  users  keep  manual  records  on  their  patients  and  can  go  to  these 
for  immediate  needs.     And  except  in  the  emergency  room,  decisions  need  not  be  made 
instantaneously.     They  have  the  time  to  go  to  the  mgmual  records  or  wait  a  few  hours 
for  a  printout. 

But  the  ease  of  programming  in  GALS  and  STARGEN  does  allow  the  system  to  respond 
to  special  emergencies.     For  example,  when  Rockland  Psychiatric  Center  faced  an 
employee  strike ,  emergency  plans  had  to  be  made  to  transfer  600  patients  to  other 
facilities.     Each  transfer  facility  received  a  computer  list  of  patients  and  their 
drug  regimes  so  that  there  would  be  no  interruption  in  chemotherapy.     This  was  done 
in  one  day,  which  would  have  been  impossible  without  the  computer. 

Another  emergency  involved  an  ex-patient  who  was  discovered  to  have  amoebic 
dysentery.     All  the  patients  who  had  been  in  his  ward  would  have  to  be  examined  for 
the  disease,  but  many  of  them  had  moved  elsewhere  and  historical  lists  of  patient 
location  are  not  kept  manually.     The  computer  retrieved  a  list  of  all  patients  who  had 
been  in  that  particular  ward  at  that  time  plus  their  current  locations.  Examination 
of  these  patients  revealed  several  more  cases;     they  were  treated,  and  a  possible 
epidemic  was  averted. 
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At  an  MSIS  facility  in  Connecticut,  an  ex-patient  had  allegedly  committed  a 
murder.     When  the  press  reported  that  he  was  a  released  patient,  the  Governor 
inquired  whether  the  facility  was  releasing  patients  too  soon.     A  statistical  report 
was  compiled  on  patient  releases  that  showed  the  hospital  was  acting  consistently 
with  trends  throughout  the  state. 

The  foregoing  are  only  a  few  of  the  many  examples  of  MSIS'  versatility  and 
capabilities.     Now  in  its  eighth  year  of  operation,  MSIS  is  a  stable,  proved  system, 
which  is  attracting  facilities  all  over  the  world  to  use  MSIS  forms  and  techniques 
in  their  own  mental  health  information  systems.     In  this  country,  facilities  in 
Alabama,  Nebraska,  Hawaii  and  Tennessee  use  MSIS  software,  and  the  State  of 
Tennessee  processes  the  data  for  a  Georgia  facility.     Overseas,  Israel,  Indonesia, 
Italy,  Belgium  and  Canada — either  governmentally  or  through  individual  facilities — 
now  use  MSIS  forms  and  techniques. 

In  addition,  there  are  several  other  advanced  computer-based  mental  health 
information  systems  in  operation,  such  as  the  Missouri  Department  of  Mental  Hygiene, 
the  Walter  Reed  Army  Medical  Center  in  Washington,  and  the  Fort  Logan  Health  Center 
in  Denver.     There  are  also  regional  or  national  computer  networks  organized  around 
identified  records  about  a  single  disease  or  condition,  such  as  the  National 
Arthritis  Data  Base  system  created  under  the  National  Arthritis  Act  of  197^.  There 
is  no  doubt  that  the  techniques  pioneered  by  MSIS  and  similar  single-facility  or 
multi-state  information  systems  will  be  used  far  more  widely  for  mental  health  and 
other  medical  data  systems  in  the  coming  years.     This  gives  the  policies  of  MSIS  as 
to  citizen  rights  their  special  importance. 

Citizen  Rights  Issues 

Because  MSIS  is  a  pool  of  patient  information  drawn  from  many  health-care  centers 
in  many  states,  and  MSIS  itself  does  not  administer  care  or  adjudicate  payment  claims, 
several  elements  of  citizen  rights  discussed  In  other  profiles  are  either  peripheral 
to  or  take  on  different  forms  for  MSIS. 

Take  the  issue  of  patient  access,  for  example.  MSIS  has  never  been  asked  by  a 
patient  to  provide  his/her  record;  if  it  were,  it  would  refer  the  patient  back  to 
the  facility  where  the  treatment  originates  and  the  original  record  was  generated. 
The  patient  access  policies  of  the  participating  facilities  run  the  gamut  (very 
narrow)  of  similar  mental  health  care  facilities,  whether  the  records  are  kept 
manually  or  computerized.     Some  require  a  court  order  from  the  patient's  attorney 
to  verify  that  the  attorney  is  representing  the  patient  and  there  is  "good  cause"  to 
provide  the  record  (advice  of  the  Mental  Health  Officer  at  Rockland) 5  others  require  a 
subpoena  (Connecticut  Mental  Health  Center),  although  this  Center's  clinicians  are 
sometimes  willing  to  discuss  a  patient's  record  with  him  without  actual  providing 
a  copy  of  it.     But  in  ajiy  case,  MSIS  does  not  set  the  standards  for  patient  access 
to  the  original  records  kept  in  participating  facilities,  and  it  believes  that 
patient  access  is  "not  an  issue." 

The  Connecticut  Center  reports  that  "patients  are  asking  to  see  their  records 
now."    In  the  spring  of  197^,  ABC  television  broadcast  a  program  called  "The  Paper 
Prison,"  dealing  with  a  variety  of  record  keeping  settings  and  detailing  people's 
problems  in  getting  access  to  and  correcting  their  records  in  schools,  police 
departments,  the  military,  and  delinquency  programs.    Following  the  program,  the 
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Connecticut  Mental  Health  Center  has  received  about  8  or  9  requests  per  month  from 
patients  who  want  to  see  their  records,  compared  to  1  or  2  requests  per  month 
previously.     No  one  has  specifically  asked  for  computerized  records.     When  a 
patient  requests  his  records,  officials  at  the  Connecticut  Center  tell  him  that  they 
cannot  give  him  the  records  unless  he  obtains  a  subpoena  or  arranges  this  directly 
with  his  clinician.     Many  clinicians  will  share  information  from  the  records  with 
the  patients  by  reading  it  to  them  or  discussing  it  with  them,  but  very  few  doctors 
agree  to  show  the  records  to  the  patient  or  provide  a  copy  of  them.    According  to 
Michael  Levine  of  the  Center,  several  patients  have  gone  to  court  over  access  rights, 
but  so  far  all  of  them  have  lost.    He  feels  that  eventually  this  situation  will 
change,  ajid  when  it  does,  the  nature  of  the  patient  record  will  chajige;:  doctors 
will  withhold  certain  information  from  the  record  if  they  know  that  the  patient  may 
read  it. 

As  a  theoretical  matter.  Dr.  Laska  states  that  MSIS  would  like  to  work  with  its 
user  panels  and  with  advisory  groups  to  make  the  system  "a  pioneer  in  affording 
patient  access."    But  it  is  not  clear  just  what  this  would  mean,  and  he  recognizes 
that  any  system  giving  patients  access  to  MSIS  files  themselves  would  probably 
require  passage  of  new  access  laws  in  the  participating  states. 

The  issue  of  privacy  in  the  MSIS  system,  in  the  sense  of  what  patient 
information  is  collected  and  recorded,  should  be  examined  in  light  of  the  flexibility 
MSIS  gives  participating  facilities  in  deciding  what  data  to  store  in  the  MSIS 
computer.     It  is  worth  repeating  in  this  context  that  only  six  of  the  37 
informational  items  on  the  Admissions  form  must  be  completed  to  open  a  patient  record, 
and  the  only  other  form  required  is  a  Termination  record.     Moreover,  participating 
facilities  may  omit  the  patient's  name  and  social  security  number  entirely,  using  a 
unique  number  or  code  as  the  record  key.     Beyond  the  minimum  items,  MSIS  does  not 
mandate  what  information  is  to  be  stored,  or  provide  guidelines  about  what  data 
collected  locally  is  to  be  used  only  at  that  facility,  whether  manually  or 
computerized.     These  practices  vary  from  state  to  state  and  from  one  participating 
institution  to  another.     For  example,  Massachusetts  does  not  collect  and  store  patient 
drug  abuse  information,  and  Connecticut  does  not  store  any  information  on  patients' 
criminal  records. 

Some  participating  institutions  provide  chaplains  with  a  list  of  inpatients  of 
their  faith,  so  they  will  know  whom  to  visit.     One  facility  gets  a  list  of  Jewish 
patients  to  whom  matzoh  will  be  distributed  during  Passover.     Some  participating 
states  use  ethnic  and  religious  data  to  insure  that  there  is  no  discrimination  on 
the  part  of  service  delivery  agencies.     But  again,  what  information  is  collected  by 
the  participating  facility  and  for  what  purpose  it  is  retrieved  depends  on  decisions 
made  by  the  facility,  not  by  MSIS,  and  these  decisions  would  likely  be  made  the 
same  way  whether  the  records  were  kept  manually  or  computerized,  whether  stored 
locally  or  centrally.     So  the  issue  of  privacy,  in  the  context  of  MSIS,  is 
interesting,  but  not  central. 

What  _is  central  is  the  confidentiality  of  the  records  that  MSIS  stores.  "The 
mere  fact  that  a  patient  has  been  hospitalized  in  a  psychiatric  institution  must  be 
kept  confidential,"  Dr.  Laska  believes.    How  to  assure  this  is  the  direct 
responsibility  of  MSIS,  and  its  managers  have  done  considerable  thinking-  "agonizing" 
would  not  be  too  strong  a  term  -  about  how  to  create  an  unbreachable  system,  -  one 
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that  would  be  both  legally  protected  and  physically  secure  at  each  end  so  that  the 
data  flowing  between  the  participating  facility  terminal  ajid  MSIS  could  not  be 
intercepted. 

In  part,  the  MSIS  efforts  were  stirred  by  public  attacks  on  their  operation. 
In  May  of  1970,  an  article  appeared  in  the  New  York  Times  describing  computer  uses 
in  the  mental  health  \field ;  one  of  the  examples  treated  at  length,  in  generally 
favorable  terms,  was  MSIS.     A  month  later.  Jack  Anderson  wrote  a  nationally- 
syndicated  column  that  attacked  MSIS  as  a  threat  to  patient  privacy  ajid  the 
confidentiality  of  the  physician-patient  relationship. 

"A  New  York  State  hospital,"  he  said,  "at  a  cost  of  millions  to  the  taxpayer, 
is  assembling  an  awesome  data  bank  of  highly  specific,  supposedly  confidential 
information  about  psychiatric  patients  in  seven  states."    MSIS  "could  be  another  step 
toward  a  national  data  center,"  which  would  "extinguish  forever  the  right  of 
privacy."    Anderson  was  particularly  concerned  with  the  possibility  that  government 
investigative  agencies  could  subpoena  patient  information  and  that  the  "all-knowing, 
never-forgetting  electronic  machines  could  produce  at  the  press  of  a  button  a  person's 
life  from  cradle  to  grave . " 

The  Anderson  attack  was  followed  by  inquiries  from  a  number  of  concerned  groups 
who  voiced  their  concerns  over  possible  violations  of  privacy.     Senator  Sam  Ervin 
and  a  number  of  individual  members  of  the  House  of  Representatives  wrote  to  HEW  to 
find  out  what  precautions  were  being  taken  to  protect  confidential  information. 

John  Shattuck,  the  ACLU  staff  lawyer  specializing  in  privacy  issues,  wrote  also, 
and  noted  that  the  ACLU  was  particularly  concerned  that  "without  proper  safeguards, 
these  (psychiatric  records)  could  well  fall  into  the  hands  of  unauthorized  people." 

In  Sanford,  Maine,  employees  of  the  state  and  federally  funded  York  County 
Counseling  Center    refused  to  fill  out  the  Admission  and  Termination  forms,  believing 
it  an  unwarranted  invasion  of  privacy  to  amass  and  maintain  such  data  on  clients 
without  their  express  consent. 

To  meet  these  problems,  MSIS  hired  Dr.  William  J.  Curran,  Professor  of  Legal 
Medicine  at  Harvard,  as  its  legal  counsel  in  1970.     He  and  his  staff  surveyed  the  legal 
situation  in  each  of  the  participating  states  and  examined  methods  of  insuring  that 
adequate  legal  safeguards  were  present  for  the  central  databanks. 

One  possibility  they  considered  was  the  transfer  of  control  and  ownership  of 
MSIS  to  the  New  York  State  Department  of  Mental  Hygiene ;  this  would  have  brought  into 
operation  two  sections  of  the  New  York  State  Mental  Hygiene  Law  that  protect 
confidentiality  of  department  records.     But  since  the  records  in  MSIS  concern 
patients  in  several  states,  it  seemed  inadvisable  to  place  them  under  a  government 
agency  of  another  state.     It  was  decided  that  the  Research  Foundation  for  Mental 
Hygiene,  Inc.  a  neutral,  non-governmental  organization  should  retain  control  of  the 
records,  but  that  legal  protection  for  the  records  at  the  Foundation  should  be  secured. 

One  approach  considered  was  the  creation  of  an  interstate  compact,  to  be  entered 
into  by  all  cooperating  states;  this  would  establish  the  organizational  framework  of 
the  system  and  guarantee  the  confidentiality  of  its  records  under  rules  that  would 
be  adopted  by  each  state  upon  joining  the  compact.     Such  a  compact  was  drafted  by 
Dr.  Curran,  hut  a  number  of  states  rejected  it  as  too  formal  for  an  operation  at  that 
time  still  regarded  as  in  the  experimental  stage. 
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The  alternative  chosen  was  to  seek  a  special  enabling  statute  from  the  New  York 
Legislature  extending  confidentiality  to  MSIS  and  all  of  its  records.     The  statute 
would  make  the  records  private  and  privileged  documents,  not  the  property  of  the  New 
York  Department  of  Mental  Hygiene,  nor  open  to  public-record  access. 

The  bill,  introduced  into  the  New  York  General  Assembly  early  in  1972,  stipulated 
that  the  records  and  information  stored  in  the  system  by  facilities  located  outside 
New  York  were  "not  open  for  inspection  by  any  agency  or  individual  other  thaji  the 
agency  or  facility  submitting  (them)"  and  were  "not  subject  to  subpoena  in  any  court 
or  before  any  tribunal  or  administrative  agency." 

The  prohibition  of  any  subpoena  was  justified  to  the  Legislature  on  the  ground 
that  all  of  these  records  are  secondary  sources  of  information  and  that  the  best 
evidence  for  any  court  proceedings  is  in  the  records  maintained  by  the  participating 
facility.     Therefore,  any  subpoena  should  be  addressed  not  to  MSIS,  but  to  the 
facility  at  which  the  records  originated. 

The  bill  also  provided  that  the  New  York  Commissioner  of  Mental  Hygiene  was 
empowered  to  conduct  an  annual  review  of  the  system  to  ensure  its  proper  and  lawful 
operation  in  the  interests  of  the  cooperating  states  and  facilities.     Finally,  the 
bill  gave  MSIS  the  authority  to  release  aggregate  data  for  research  purposes, 
provided  that  all  patient  identifiers  were  removed. 

This  path-breaking  law  to  provide  specialized  status  to  a  regional  medical 
information  system  became  part  of  the  New  York  Civil  Rights  Law  on  May  I5f  1972.  Thus, 
the  general  confidentiality  of  records  stored  and  controlled  by  MSIS  were  assured  by 
law. 

But  it  must  be  underscored  that  the  confidentiality  of  records  stored  locally 
by  the  participating  facilities  (as  with  the  questions  of  access  and  privacy)  are 
still  governed  by  the  various  state  laws,  just  the  same  as  other  local  facilities 
that  are  not  participants  in  the  MSIS  system.     In  Connecticut,  for  example,  a  patientfe 
record  may  be  subpoenaed,  and  state  laws  require  the  mental  health  centers  to  give 
certain  information  to  various  third  party  payers.     According  to  Lanse  Crane,  an 
attorney  and  assistant  to  the  Director  of  the  Connecticut  Mental  Health  Center,  the 
Welfare  Department  and  the  Department  of  Finance  and  Control  have  the  widest  access 
to  patient  information.     "When  it  comes  to  issues  of  money  and  paying  for  treatment, 
confidentiality  normally  takes  a  back  seat."    MSIS  sees  the  issue  of  bolstering  the 
confidentiality  laws  in  all  their  user  states  as  an  important  task  for  their 
attention,  especially  as  more  states  join  MSIS  or  similar  regional  medical  data  banks. 
In  late  1971 i  MSIS  commissioned  an  analysis  of  the  law  in  each  of  its  participating 
jurisdictions .     The  study  found  that  New  York  was  the  only  one  with  a  clear  general 
statutory  right  of  privacy.     Court  decisions  in  several  other  states  recognized 
a  common  law  right  of  privacy  while  two  states,  Rhode  Island  and  Vermont,  had  not 
recognized  the  legal  right  of  privacy. 

As  to  psychiatric  records  specifically,  the  study  found  the  New  York  law  to  have 
the  broadest  coverage  here  as  well.     New  York  recognizes  a  confidential  relationship 
and  creates  a  testimonial  privilege  for  communications  between  patients  and  their 
physicians,  psychologists,  nurses  and  social  workers.    A  few  other  states  recognized 
only  a  patient-psychotherapist  privilege. 
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As  for  patients'  clinical  records,   consultant  reports,  psychological  tests, 
drug  administration  records,  and  other  records  kept  by  mental  health  facilities, 
these  are  legally  the  property  of  the  facility.     Of  the  states  that  were  then 
participating  in  MSIS  (late  1971)  five — Connecticut,  Hawaii,  Massachusetts,  Vermont 
and  New  York — had  statutes  establishing  the  confidentiality  of  such  patient  records 
in  mental  health  facilities.     Neither  Rhode  Island  nor  the  District  of  Columbia  had 
explicit  provisions  protecting  the  confidentiality  of  such  records. 

MSIS  has  taken  other  steps  with  respect  to  confidentiality  in  addition  to 
sponsoring  the  Amendment  to  the  New  York  State  Civil  Liberties  Law  and  to  encouraging 
passage  of  state  laws. 

In  1973,  Dr.  Laska  wrote  HEW  Secretary  Casper  Weinberger,  requesting  that  MSIS 
be  "authorized  as  a  confidential  system  under  Sec.45-82  of  the  Federal  Public  Health 
and  Welfare  Law."     Such  authorization  would  give  MSIS  the  right  to  withhold 
information  identifying  the  individuals  who  are  the  subjects  of  alcoholism  research 
or  treatment  "from  all  persons  not  connected  with  the  conduct  of .. .research  on,  or 
treatment  with  respect  to,  alcohol  abuse  and  alcoholism."    Although  the  Secretary 
responded  that  a  decision  would  be  forthcoming  quickly,  as  of  late  1975 »  despite  a 
second  request,  HEW  had  given  only  unofficial  indications  that  MSIS  would  be  covered. 
MSIS  is  assuming  they  are  covered,  but  still  awaits  an  official  finding  and  notice. 

Physical  Security 

Several  technical  safeguards  are  employed  to  protect  the  physical  safety  of 
MSIS  records.     Through  a  password  system,  each  terminal  has  access  only  to  its  own 
data  files,  not  those  of  any  other  user.     Entrances  to  the  Research  Center  where  the 
MSIS  computer  is  located  are  guarded  by  personnel  or  by  electrical  security  devices. 
A  guard  is  posted  at  the  only  entrance  left  open  at  night;  all  other  entrances  are 
locked  and  are  protected  by  an  alarm  system.     The  computer  room  itself  is  locked  with 
a  combination  lock  at  all  times.     At  each  of  the  participating  facilities  in  which 
terminals  are  located  responsibility  for  securing  of  the  terminal  room  is  in  the 
hands  of  the  director  of  the  facility,  and  practices  there  vary  from  highly  secure 
to  fairly  casual. 

A  good  example  of  this  involves  patient  notice  of  and  consent  to  the  MSIS 
operation.     ACLU  chapters  in  several  of  the  states  participating  in  MSIS  have 
complained  that  while  patients  expect  their  records  to  be  compiled  and  used  in  the 
local  facilities  treating  them, or  that  identified  data  may  be  needed  for  state 
health-care  evaluation  and  planning,  they  do  not  expect — nor  would  all  of  them 
welcome — the  sending  of  their  extensive,  highly-sensitive  records  to  a  central 
computer  in  New  York  State.     The  ACLU  complaints  have  stressed  that  MSIS  may  be  an 
exemplary  system  in  terms  of  its  confidentiality  safeguards,  but,  if  so,  it  should  be 
all  the  more  willing  to  have  the  patients  whose  records  will  be  lodged  there  informed 
of  this  practice.     When  the  purposes  and  uses  of  MSIS  and  its  protections  are 
explained,  the  patient  (or  a  legal  guardian  in  case  of  incompetence)  can  make  an 
informed  decision  as  to  whether  his  or  her  records  should  go  into  MSIS.     Not  to 
provide  such  a  process,  the  ACLU  groups  charge,  is  to  create  just  the  kind  of 
"secret  data  system"  that  the  1973  HEW  Report,  the  federal  Privacy  Act  of  197^,  and 
several  state  fair  information  practices  acts  have  condemned  as  unacceptable.  MSIS 
officials  have  not  yet  faced  this  issue  head  on,  but  have  treated  it  as  a  matter 
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governed  by  the  notice  and  consent  policies  of  the  local  facilities. 

Despite  its  efforts  on  behalf  of  confidentiality,  ajid  more  important,  despite 
the  fact  that  no  one  has  documented  a  single  leak  of  information  from  MSIS  in  the 
eight  years  of  its  existence,  or  any  violation  of  the  strict  rules  of  confidentiality 
under  which  it  holds  personal  patient  data,  MSIS  continues  to  draw  considerable 
public  fire  on  citizen  rights  questions. 

Future  Plans 

MSIS  personnel  are  developing  a  financial  system  to  help  mental  health 
facilities  track  costs.     Their  major  new  activity  currently  is  development  of  an 
information  system  for  treating  the  mentally  retarded,  under  a  3-year  grant  from  the 
Social  Rehabilitation  Services  of  HEW.     They  are  also  conducting  studies  under  an 
NIMH  grant  of  how  psychiatric  records  are  actually  used  by  clinicians  and  institutions 
in  their  decision-making  as  to  treatment.     Another  project  is  to  design  aji  outpatient 
drug  review  system.     MSIS  officials  see  the  use  of  their  system  as  a  bedrock  for 
PSRO  review  of  mental  health  care,  and  a  necessity  if  and  when  a  national  health 
insurance  program  is  enacted.     "MSIS  will  have  a  major  role  in  setting  quality  care 
standards  in  psychiatry,"  Dr.  Laska  believes.     Meanwhile,  new  states  continue  to 
come  onto  the  system  each  year,  or  utilize  its  software,  or  purchase  its  forms. 

Observations 

Considering  all  of  MSIS  efforts,  and  considering  its  unbreached  security  record, 
the  protests  about  its  activities,  in  another  era,  would  very  likely  be  considered 
somewhat  paranoid.     In  today's  world,  they  are,  alas,  all  too  plausible.     In  the 
last  three  years,  the  American  people  have  been  bombarded  with  documented  accounts 
of  government  investigators  illegally  obtaining  confidential  information — confidential 
information  protected  by  both  physical  security  and  by  laws  as  stringent  as  the  New 
York  State  Civil  Rights  Law.     While  the  break-in  at  the  office  of  Daniel  Ellsberg's 
psychiatrist  and  the  exposure  of  Sen.  Thomas  Eagleton's  psychiatric  history    are  the 
most  notable  in  the  area  of  mental  health  records,  other  violations  have  done  as  much 
or  more  to  create  cynicism  about  the  supposed  confidentiality  of  health  records. 
The  FBI's  illegal  wire-tapping  of  members  of  the  National  Security  Council,  the  CIA's 
illegal  opening  of  mail  of  hundreds  of  thousands  of  American  citizens;  the  stealing 
of  records  by  the  FBI  or  its  informants  belonging  to  anti-war  groups  such  as  the 
Institute  for  Policy  Studies  -  all  these  and  more  have  heightened  public  consciousness 
of  the  fragility  of  so-called  confidential  records.     Adding  to  the  climate  of 
distrust  are  the  activities  of  local  law  enforcement  agencies  which  have  been 
revealed  in  the  past  few  years:  police  departments  in  most  major  American  cities. 
New  York,  Baltimore,  Washington,  Chicago  and  Los  Angeles  among  them,  have  been 
charged  with  illegal  procurement  of  confidential  documents. 

In  this  atmosphere,  it  is  easy  to  conjure  up  situations  in  which  the 
confidentiality  of  systems  like  MSIS  might  be  overridden  in  the  interest  of  "national 
security" — tracking  down  a  potential  presidential  assassin,  say,  or  an  unstable 
security  risk.     It  is  easy  to  imagine  that  its  confidentiality  might  be  overridden 
for  law  enforcement — tracing  a  kidnapper  who  was  thought  to  be  an  ex-patient.  Once 

*Made  public,  ironically,  by  Jack  Anderson. 
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breached  for  such  overriding  concerns,  the  system  might  be  riddled  by  investigations 
of  every  kind  because  the  very  existence  of  easily-retrieved,  identified  records 
on  people  whose  problems  include  drug  abuse,  alcoholism,  sexual  deviations  and 
violent  episodes  is  a  tremendous  temptation  to  local  and  national  law  enforcement 
agencies;  therefore  the  very  existence  of  such  systems  threatens  citizens'  rights, 
its  critics  conclude. 

There  is  no  facile  answer  to  the  question  of  how  to  reconcile  the  need  to  deliver 
the  improved  mental  health  care  that  MSIS  promises  with  the  need  to  guarantee,  in 
some  as  yet  undefined  way  that  goes  beyond  the  laws  and  beyond  physical  security, 
the  total  confidentiality  of  mental  health  records.     Yet  the  public  acceptance  of 
systems  like  MSIS  will  depend  on  developing  strong  and  publicly-acceptable  safeguards. 
Again,  we  will  return  to  this  issue  in  our  concluding  chapter. 
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SOURCES 

A  site  visit  was  made  to  MSIS  by  Alan  Westin  and  a  visit  to  the  Connecticut 
Mental  Health  Center,  New  York,  by  staff  member  Jamie  Broder  during  the  summer  of 
197^.     Continuing  contacts  were  had  with  MSIS  officials  by  Alaji  Westin  and  Helene 
Toiv  down  to  February  of  1976. 

The  most  detailed  discussion  of  MSIS  can  be  found  in  Eugene  M.  Laska  and 
Rheta  Bank,  Safeguarding  Psychiatric  Privacy;  Computer  Systems  and  Their  Uses  (N.Y. : 
John  Wiley  and  Sons,  1975).     Other  useful  publications  include:  Eugene  M.  Laska, 
et  al.,   "The  Multi-State  Information  System,"  Evaluation.  Fall,  1972,  p. 66  ; 
Jeffrey  L,  Crawford , Donald  W.  Morgan,  and  Daniel  T.  Gianturco,  Progress  in  Mental 
Health  Information  Systems;  Computer  Applications  (Cambridge,  Massachusetts, 
Ballinger  Publishing  Company,  197^);     IBM,  "The  Multi-State  Information  System  for 
Psychiatric  Patients,"  Application  Brief;    Eugene  Laska,  Ervin  Varga,  Joseph 
Wanderling,  George  Simpson,  George  W.  Logemann  and  B.K.  Shah,   "Patterns  of 
Psychotropic  Drug  Use  for  Schizophrenia,"  Diseases  of  the  Nervous  System,  3^; 
294-305,  August/September,  1973*     Carole  Siegel,  et  al. ,   "Evaluating  the  Attainment 
of  Process  Objectives  of  Community  Mental  Health  Centers  Using  An  Automated  Patient 
Data  System — MSIS,"  NIMH,  197^  5  William  J.  Curran,  Eugene  M.  Laska.,  et  al.  , 
"Protection  of  Privacy  and  Confidentiality,"  Science ,  November  23,  1973 »  p. 799  J 
Marguerite  Zientara,   "Mass.  Crops  Names  on  Multi-State  Psychiatric  Bank," 
Computerworld,  November  7,  1973 »  P-'+J    Nancy  Hicks,   "Computer  a  'Tool'  in  Mental 
Health,"  New  York  Times,  May  3,  1970s     Jack  Anderson  Column,  in  the  Rockland,  N.Y. 
Journal  News ,  June  I7,  1970;      R.  Clinton  Taplin,  "Computers — Mental  Health  Boon  or 
Risk,"  The  Record,     May  l4,  1973  (Hackensack,  New  Jersey). 

For  personal  interviews,  we  are  grateful  to  Dr.  Eugene  M.  Laska;  Rheta  Bank; 
Dr.  Boris  Astrachan;  Michael  S.  Levine ;  Lance  Crane;  and  Robert  Lawrence. 
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CHAPTER  10.     MUTUAL  OF  OMAHA  INSURANCE  COMPANY 

Mutual  of  Omaha  is  a  multi-line  insurance  company  with  health  insurance  as  one 
of  its  major  offerings.     A  profit-making  enterprise,   its  operations  are  guided  by  the 
standard  of  cost-effectiveness  and  commercial  success.     We  chose  Mutual  because  it  is 
the  largest  and  best-known  of  the  commercial  health  insurers  in  the  United  States, 
because  it  is  one  of  the  most  advanced  computer  users  among  Zone  2  service  payers, 
and  because  recent  privacy  legislation  has  not  only  had  some  important  effects  on 
Mutual's  data  collection  practices,  but  has  also  raised  questions  about  how  Mutual 
will  select  risks  and  administer  claims  investigations  in  the  future. 

Background  on  Mutual 

Organized  in  1909 »  Mutual  has  grown  along  with  the  health  industry  and  is  now 
the  world's  largest  provider  of  individual  and  family  health  insurajice.     It  offers 
policies  covering  hospital  and  surgical  payments,  extra  hospital  expenses,  payments 
for  specific  diseases  such  as  cancer,  income  protection  for  illness  or  hospitalization 
and  a  variety  of  plans  that  take  effect  when  programs  like  Medicare  or  Blue  Cross  stop 
paying.     Mutual  is  licensed  throughout  the  United  States,  Canada,  Britain,  Puerto  Rico 
and  a  few  other  locations.     Seven  other  subsidiaries  offer  life  insurance,  mutual 
funds,  travel  insurance,  and  other  lines,  and  Mutual's  assets  in  197^+  were  over 
$750  million. 

Information  Collection  for  Underwriting 

As  with  other  commercial  insurance  companies.  Mutual,  while  eager  to  sell  as 
many  policies  as  possible,  is  also  eager  to  weed  out  policy  applicants  who  are  poor 
health  risks,  or  are  unlikely  to  be      able  to  pay  their  premiums,  or  might  make 
fraudulent  claims  for  benefits.     These  goals  dictate  the  collection  of  a  broad  range 
of  information  directly  from  the  applicant  for  a  policy — information  about  the 
applicant's  financial  affairs,   job  amd  style  of  life,  in  addition  to  medical  history. 
The  medical  part  of  the  policy  application  calls  for  an  account  of  injuries  and 
medical  treatment  and  a  listing  of  diseases,  including  high  blood  pressure,  arthritis, 
cancer,  syphilis,  epilepsy  and  mental  disorders. 

Until  recently,  Mutual's  application  included  the  question:  "Are  your  and  your 
dependents'  morals  and  habits  correct  gind  temperate?"    While  few  people  were  expected 
to  answer  "no",  the  company  saw  this  as  putting  the  applicant  on  notice  that  his/her 
morals  would  be  considered  in  deciding  to  issue  a  policy.     The  question  was  recently 
deleted  from  Mutual's  new  application,  after  the  compemy  decided  it  didn't  provide 
the  underwriting  department  with  any  useful  information.     "What  one  person  considers 
moral,"  comments  Albert  Hansen,  Senior  Vice  President,  "another  does  not... We  are 
much  better  served  by  the  specific  inquiries  (e.g.  whether  the  applicant  has  ever 
been  treated  for  alcoholism  or  drug  addiction, or  had  venereal  disease)  in  evaluating 
the  individual  medically  as  well  as  from  those  habits  which  could  more  likely  affect 
insurability."    The  Company  says  that  an  admission  of  having  been  treated  for  either 
alcoholism  or  drug  addicticn  will  not  by  itself  result  in  denying  coverage,  but  would 
depend  on  the  results  of  further  investigation.     In  addition,  "no"  answers  will  not 
be  investigated.    However,  should  it  subsequently  be  discovered  (especially  in  a 
claims  proceeding)  that  the  applicant  had  not  told  the  truth  about  a  substantive 
matter,  the  insurance  contract  could  be  declared  invalid  £ind  the  claim  denied. 
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Although  questions  about  morals  and  habits  are  now  omitted  from  the  applicant's  form, 
they  still  play  a  role  when  the  company  decides  to  make  an  investigatory  check  of  the 
application.   (See  below). 

In  compliance  with  the  federal  Fair  Credit  Reporting  Act,  which  took  effect  in 
1971,  the  company  includes  in  its  policy  applications  a  pre-investigation  notice 
which  reads  as  follows: 

"This  is  to  inform  you  that  as  part  of  our  procedure  for  processing  your 
application  an  investigative  consumer  report  may  be  prepared  whereby  information  is 
obtained  through  personal  interviews  with  your  neighbors,  friends  or  others  with  whom 
you  are  acquainted.     This  inquiry  includes  information  as  to  your  or  your  dependents' 
(if  family  insurance)  character,  general  reputation,  personal  characteristics  and 
mode  of  living. . . " 

This  notice  is  detached  from  the  policy  and  handed  to  the  applicant  when  he 
fills  out  the  form,  to  insure  that  proper  notice  has  been  given. 

As  part  of  the  application,  the  prospective  customer  lists  the  doctors  and 
hospitals  from  whom  he  has  received  treatment.     He  signs  a  statement  which  authorizes 
"any  physician,  hospital,  insurer  or  other  organizations  having  any  records  or 
knowledge  concerning  (the  applicant)  or  (his)  dependents  to  give  such  information  to 
Mutual  of  Omaha  Insurance  Company."    If  important  health  history  items  are  listed, 
the  company,  using  this  authorization,  may  check  further  with  the  physician  or 
hospital.     "In  general,  physicians  and  hospitals  comply  with  our  requests  for  medical 
data,"  remarked  Hansen.     "Of  course,  there  is  always  someone  who  decides  for  one 
reason  or  another  that  everything  is  confidential."    In  that  case,  the  corapajiy's 
medical  personnel  would  evaluate  the  situation  and  decide  whether  to  go  ahead  of  to 
require  further  disclosure  of  verification  from  the  applicant. 

In  addition  to  the  individual  application.  Mutual  uses  a  number  of  other  sources 
to  investigate  some  applicants.     It  checks  its  own  files  to  see  if  there  is  any 
previous  coverage  or  claims  records.     It  has  its  own  investigators  make  an  inspection 
in  cases  where  "an  application  is  incomplete  or  otherwise  suspicious,  or  because  the 
policy  applied  for  is  a  large  one  -  for  instance,  to  cover  more  than  $300  per  month  in 
loss-of-time  income." 

Where  their  own  investigators  are  not  available.  Mutual  may  get  an  "inspection 
report"  from  a  commercial  reporting  firm  such  as  Equifax  (formerly  Retail  Credit)  or 
Hooper  Holmes.      Hansen  notes  that  "these  are  fairly  minimum  checks;  we  get  something 
on  general  character  through  reputation  elicited  from  neighbors  and  references  listed 


*I\1ost  of  the  reports  that  Equifax  does  for  Mutual  are  Income  Protection  Reports,  and 
are    handled  by  personal  or  telephone  interviews  with  the  applicant.     The  report  has 
sections     on  health,  drinking,  and  drugs.     Among  the  health  questions  are  ones  asking 
about    any  illnesses  or  operations,  regular  medication,  rejection  for  military  service 
or  discharge  for  medical  reasons,  name  and  address  of  personal  physician  and  "when  was 
last  visit,  for  what  reason,  what  results."    If  the  applicant  is  not  available  for 
direct  interview,  EquifsLX  will  contact  an  employer  or  neighbor  and  ask  about  that 
person's  knowledge  of  these  facts.     Such  persons  are  also  asked  whether  they  know 
"anything  adverse  about  character,  life  style,  general  reputation  or  home  environment." 
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on  the  application  -  and  we  confirm  things  like  employment,  length  of  residence  and 
neighborhood  environment.     We  don't  automatically  assume  that  all  of  the  information 
we  see  in  an  investigatory  report  is  true.     All  findings  are  subject  to  verification." 
About  a  third  of  these  investigations  are  done  by  Mutual's  ovm  people,  and  two-thirds 
by  outside  commercial  firms.     Of  the  700,000  insurance  applications  received  annually, 
about  50,000  {7%)  are  checked  by  investigations. 

Mutual  approves  at  least  95%  of  the  applications  submitted  to  it.     This  means 
that  about  30  to  35  thousand  people  a  year  are  denied  health  insurance  policies. 

Health  history  is  by  far  the  most  common  reason  for  denying  coverage,  but  other 
factors  sometimes  play  a  role.     Actuarial  studies  which  take  into  account  age,  sex 
and  geographical  airea  may  also  be  determinative.     "Sometimes  geographical  factors 
come  up,"  a  Mutual  official  said,   "for  instance  in  parts  of  some  cities  where  the 
health  and  hospital  facilities  and  environment  may  be  very  bad."    Although  it  caji  be 
inferred  that  such  geographical  factors  would  be  most  likely  to  come  into  play  in 
ghetto  areas,  whose  populations  are  largely  black  or  Spanish  surnamed,  race  cajinot 
be  an  explicit  factor  in  insurance  underwriting  under  federal  Civil  Rights  Laws. 

Asked  about  homosexuality  in  health  insurance  decisions,  a  factor  about  which 
protests  have  been  raised  in  the  life  insurance  industry,  a  Mutual  official  said: 
"It  doesn't  come  up  and  we  don't  look  for  itj  even  if  it  did  come  up,  we  wouldn't  use 
it  unless  there  was  accompanying  information  with  some  real  health  implications.  You 
have  to  realize  that  we  want  to  sell  insurance  and  that  most  of  our  policy 
applications  go  through  without  a  hitch." 

Mutual,  like  most  of  the  insurance  industry,  feels  somewhat  inhibited  in  its 
information -gat he ring  activities  because  of  the  Fair  Credit  Reporting  Act  (FCRA). 
According  to  Hansen,  certain  applicants  may  believe  that  they  no  longer  have  to 
answer  certain  inquiries  posed  by  investigators.     As  a  result,  the  company  finds  that 
investigative  reports  that  it  purchases  from  outside  commercial  firms  (Consumer 
Reporting  Agencies,  under  the  Act)  are  not  as  useful  as  they  were  before  the  FCRA  was 
passed.     "To  illustrate,  in  order  to  qualify  for  insurance,  a  person  must  have  a 
certain  income.     If  an  applicant's  financial  situation  is  shaky,  for  example  he  has 
walked  away  from  two  businesses  and  filed  for  bankruptcy,  you  may  not  want  to  take 
as  great  a  risk  on  him  as  you  might  ordinarily,  or  you  might  want  to  charge  a  higher 
rate  for  the  coverage  applied  for.    For  all  we  know,  the  applicant  may  be  setting  us 
up  for  a  disability.     The  Fair  Credit  Reporting  Act  might  preclude  the  company  from 
securing  that  type  of  financial  information." 

Claims  Investigations 

Claims  for  benefits  call  for  further  information-gathering  on  policyowners.  To 
collect  on  a  claim,  the  policyowner  must  submit  a  proof  of  loss  form  on  which  he 
authorizes  his  physiciem  to  furnish  medical  information.     Where  a  policy  pays  as  soon 
as  a  disease  is  discovered.  Mutual  may  request  only  a  diagnosis  from  the  physician. 
For  other  kinds  of  policies,  detailed  descriptions  of  medical  procedures  are  required. 
However,  the  company  says  that  most  investigations  of  claims  are  made  only  to 
establish  that  the  loss  is  covered  within  the  framework  of  the  policy  provision. 
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Computerization  At  Mutual 

In  195^»  when  Mutual's  yearly  business  had  grown  to  $5.1  million  in  policy 
applications  and  $5.9  million  in  benefit  claims,  a  committee  from  Mutual  and  its 
life  insurance  affiliate,  United  of  Omaha,  began  to  plan  for  automating  some  of  the 
firm's  routine  and  costly  high  volume  tasks.     At  every  step  in  the  planning  process, 
Mutual  officials  recall,  cost  effectiveness  was  the  key  criterion.   (A  recent  Industry 
study  found  that  Mutual's  operational  expenses  are  less  than  the  combined  average  of 
the  next  24  companies  in  the  field). 

James  J.  Kohanek,  Vice-President  for  Computer  Systems,  says  that  since  the 

company's  first  computer  was  delivered  in  1957t  the  operation  has  grown  so  that  "now 

ti 

we  do  everything  but  cut  the  lawn  with  our  computers.     The  core  of  the  system  is  its 
Consolidated  Policy  Accounting  System,  covering  its  regular  lines  of  individual  health 
policies  and  handling  some  $20  million  in  premium  payments  each  month.     This  is  a 
batch-processed  file  containing  detailed  records  for  each  current  policy i  identifying 
information,  premium  payments,  benefit  information,  etc.     The  system  handles  70,000 
benefit  requests  each  month  and  issues  nearly  9,000  benefit  checks  each  weekday.  On 
a  given  day,  approximately  900,000  active  benefit  records  are  on  tape,  containing 
skeleton  histories  on  the  benefits  granted  and  coded  references  to  types  of  disability 
involved.     The  local  Mutual  representative,  presented  with  a  policyowner's  benefit 
claim,  can  usually  be  supplied  by  the  following  morning,  with  the  account  information 
he  needs  to  begin  processing  the  claim. 

Because  Mutual  finds  benefit  history  important  for  developing  new  health 
insurance  policies  and  for  considering  new  applications  from  individuals  already 
covered  under  smother  Mutual  policy,  they  store  on  tape  the  benefit  histories  of  more 
than  5  million  policyowners.     Each  record  contains  items  such  as  diagnoses,  benefits 
paid,  and  actions  taken  on  the  policy.     These  are  available  on  an  overnight  basis 
to  authorized  Home  Office  personnel. 

In  addition  to  active  individual  policies,  the  computer  also  handles  the 
processing  of  benefits  for  its  group  insurance  programs,  keeps  some  records  on  Mutual 
employees  and  agents,  and  produces  management  reports. 

Mutual's  Role  in  Medicare  and  Champus  Programs 

Mutual  serves  as  fiscal  intermediary  for  Part.  B  of  the  Medicare  program  (payment 
of  doctor  ajid  outpatient  bills)  for  the  State  of  Nebraska,  processing  about  440,000 
claims  a  year  under  an  automated  system  developed  by  the  Social  Security  Administration. 
It  also  handles  435,000  Medicare  Part  A  claims  (hospital  bills)  for  various  hospitals, 
health  agencies,  and  nursing  homes  in  31  states  and  the  District  of  Columbia;  these 
are  handled  through  manual  procedures. 

Eligibility  data  on  all  Medicare'  beneficiaries  is  stored  in  Baltimore  in  the 
computer  files  of  the  Social  Security  Administration.     When  Mutual  receives  a  charge 
claim  under  Medicare  Part  B,  it  first  conducts  a  computerized  "medical  audit"  to  see 
whether  it  falls  within  "acceptable  parameters".  A  manual  examination  is  done  to  see 
whether  the  treatment  was  really  necessary  and  whether  the  health  service  rendered  is 
covered  by  Medicare.     Claims  meeting  these  criteria  are  keypunched  and  sent  to  the 
SSA  central  file  to  verify  eligibility.     If  the  reply  is  satisfactory,  Mutual's 
computer  issues  the  checks.     Both  by  law  and  contract,  eligibility  information 
obtained  from  SSA  tapes  and  communications  cannot  be  used  for  any  other  purpose. 
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According  to  Ben  Patterson,  Mutual's  director  of  Medicare  Administration,  the 
automated  system  is  by  no  means  flawless.     There  are  often  delays  in  receiving 
eligibility  data  from  the  Social  Security  Administration,  and  each  time  there  is  a 
legislative  change  in  the  program,  it  takes  a  substantial  period  of  time  for  the 
computer  programming  alterations  to  arrive  from  Baltimore.     Nevertheless,   "(i)f  it 
weren't  for  the  computer  there  would  be  no  Medicare  program,"  he  said;  "we  would  be 
drowned  in  data."    Furthermore,  the  problems  of  detecting  duplicate  claims  has  been 
substantially  alleviated. 

The  Civilian  Health  and  Medical  Program  of  the  Uniformed  Services  (CHAMPUS) 
is  a  federal  program,  to  pay  the  cost  of  civilian  medical  services  for  dependents  of 
armed  forces  personnel  where  such  services  are  not  available  in  military  hospitals. 
Eligibility  is  limited  to  dependent  spouses  and  children  of  service  members  on  active 
duty  or  training;  certain  retired  service  people,  and  dependents  of  service  people 
killed  on  active  duty.     Among  the  services  covered  by  CHAMPUS  are  treatment  of 
medical  or  surgical  conditions}  nervous,  mental  and  emotional  disorders}  chronic 
conditions  and  diseases}  allied  medical  service  such  as  occupational  and  physical 
therapists,  audiologists,  social  workers,  and  remedial  reading  teachers}  abortions, 
if  locally  legal}  family  planning  services,  marriage  and  pastoral  counseling}  and 
prescription  drugs. 

Mutual  processes  CHAMPUS  hospital  claims  in  seventeen  states  and  physicians 
claims  in  six  states  plus  Puerto  Rico,  Canada  and  Mexico.     CHAMPUS  claims  are 
processed  by  an  integrated  on-line  system,  with  sixty-three  terminals. 

Fifty-six  terminals  axe  dedicated  to  the  claims  audit  function  and  each  CHAMPUS 
claims  auditor  is  issued  a  code  that  permits  access  to  these  terminals.     When  a  claim 
is  received,  the  claimant's  name,  social  security  number,  date  of  birth,  emd  other 
identifying  data  are  fed  into  the  computer,  v/hich  audits  the  charge  for  the  services 
rendered.     In  addition  to  issuing  checks  to  claimants,  the  computer  generates  daily 
disposition  lists  of  all  claims  processed,  letters  to  claimants  requesting  additional 
data,  and  explanations  of  benefits. 

Sixteen  months  of  benefits  history  are  stored  in  Mutual's  CHAMPUS  data  bank. 
History  data  beyond  that  period  are  stored  on  microfilm.     All  claim  records  are  filed 
in  cabinets  and  are  identified  by  an  internally  developed  numbering  scheme. 

Originally,  Mutual  processed  all  CHAMPUS  claims  manually.     The  decision  to 
automate  in  1972  was  prompted  by  the  program's  requirement  that  intermediaries  develop 
fee  profiles  on  physicians  rendering  health  services  to  CHAMPUS  beneficiaries. 

Citizen    Rights  Issues 
1 .  Confidentiality 

Mutual  regards  its  information  about  policyholders  as  confidential,  for  internal 
use.     However,  it  faces  many  problems  involving  release  of  such  data  to  outside 
agencies,  and  its  sharing  practices  have  undergone  significsmt  changes  during  the 
past  few  years.    For  example,  health  information  is  no  longer  shared  within  the 
industry  through  industrywide  pools.     Mutual  used  to  forward  limited  information  on 
policyowner's  suspected  of  filing  fraudulent  claims  to  the  Casualty  Index,  an 
industry  file  in  New  York  which  maintained  national  records  for  this  purpose.  The 
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practice  was  discontinued  in  1970.     Mutual  felt  there  was  little  danger  to 
policyowners  in  contributing  to  and  using  the  Index,  but  they  were  concerned  about 
what  policyowners  might  think  about  this  exchange,  and  it  was  ended. 

Where  a  group  health  policy  is  written  for  all  the  employees  of  a  company  or 
agency,  and  Mutual  administers  it  directly,  Mutual  does  not  release  identified 
employee  health  information  to  the  employer.     However,  if  the  employer  administers 
the  program  through  its  own  claims  office,  Mutual  has  no  way  of  knowing  what  is  done 
with  information  about  physical  or  mental  conditions  that  might  be  disclosed  in 
claims  forms.     Dr.  Robert  Long,  Mutual's  Associate  Medical  Director,  noted  that 
there  might  be  extreme  situations — "entirely  theoretical  so  far" — in  which  Mutual 
might  learn  of  a  health  condition  and  feel  itself  duty  bound  to  notify  the  employerj 
such  as  "a  person  who  was  epileptic  working  with  heavy  machinery." 

In  1973,  in  order  to  insure  compliance  with  the  Fair  Credit  Reporting  Act, 
Mutual  revised  its  regulations  governing  the  release  of  information  to  other  insurers. 
Without  a  signed  authorization  from  the  policyowner,  release  of  information  is  now 
limited  to  the  policyowner's  name,  address,  date  of  birth,  and  occupation,  plus  the 
type  of  policy  issued,  issue  date,  amount  of  coverage,  and  the  current  status  of  the 
policy.     With  a  signed  authorization,  release  is  limited  to  the  previously  described 
items,  plus  the  amount  of  benefits,  other  final  claims  dispositions,  and  the  source 
references  of  medical  information  contained  in  claims  files  up  to  the  date  of  the 
authorization. 

As  far  as  state  and  federal  agencies  are  concerned.  Mutual  officials  give 
confidential  data  only  when"we  have  no  legal  basis  for  denying  the  request."  Mutual 
General  Counsel  Robert  Muchemore  recalled  one  instance  in  which  the  Missouri  State 
Insurance  Department  insisted  on  copying  various  files.     Mutual  balked,  but  eventually 
complied  when  it  realized  that  the  Department  could  compel  the  production  of  these 
records  at  the  Insurance  Department,  which  could  then  make  copies.     The  Internal 
Revenue  Service  also  demands  and  obtains  individual  data  from  Mutual.     By  law,  the 
IRS  has  a  lien  on  monies  due  beneficiaries  who  are  federal  tax  delinquents.    As  a 
result,  Mutual  is  required  to  respond  to  IRS  inquiries  as  to  whether  or  not  the 
company  is  liable  to  a  particular  policyowner.     If  so.  Mutual  must  withhold  the 
benefits  from  the  insured  and  pay  it  over  to  IRS. 

At  one  time,  IRS  requested  health  insurance  carriers  to  report  all  payments 
made  to  policyowners  in  reimbursement  of  doctor  bills.    A  number  of  companies 
vigorously  resisted,  and  IRS  backed  down.     However,  as  of  1971,  all  insurance 
companies  must  report  to  IRS  the  names  of  physicians  to  whom  they  have  paid  more  than 
$600  a  year. 

Law  enforcement  officers  occasionally  approach  Mutual  with  a  fugitive  warrant 
and  ask  for  the  address  of  an  individual.     This  is  provided.     However,  "no  medical 
or  benefits  information  is  released,"  according  to  Mutual  officials,  £ind  Hansen  could 
recall  no  instance  in  which  law  enforcement  agents  requested  such  information. 

"FBI  agents  come  around  perhaps  three  or  four  times  a  month,"  says  Mutual 
official  James  Barrett.     "Usually  what  they  want  is  location  information,  or  they  are 
interested  in  the  flight  insurance  area  -  for  sabotage  cases  and  for  tracing  the 
interstate  movement  of  criminals." 
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In  spite  of  the  fact  that  some  reporting  to  the  federal  government  must  be  by 
social  security  number  -  (payments  to  physicians,  Medicare  and  Champus  claims)  - 
Mutual  continues  to  use  its  ovm  numbering  system  for  individual  accounts.  According 
to  Kohanek,     the  company  does  not  want  to  adopt  social  security  numbering  because  it 
would  "greatly  increase  the  problem  of  confidentiality." 

2 .  Computer  Security 

Officials  at  Mutual  recognize  that  computerization  leads  to  greater  demands  for 
both  identified  and  statistical  data.    As  an  example,  Mr.  Kohanek  mentioned  the  IRS 
requirement  on  reporting  payments  over  $600  to  physicians,  and  he  commented:  "The  only 
reason  we're  asked  to  do  it  is  because  it  can  be  done  now  by  computers."  Before 
computerization  it  would  have  been  prohibitively  costly  to  retrieve  the  requested 
data.     Today,  the  government  knows  that  the  data  are  readily  available  at  little 
cost,  and  so  they  demaind  it. 

Protection  of  files  from  unauthorized  access  was  included  in  Mutual 's  earliest 
computerization  plans.     Only  authorized  personnel  are  issued  access  codes  to  the 
computer,  and  only  within  their  delegated  area.     For  example,  though  the  underwriting 
department  is  given  access  to  information  collected  by  the  claims  department,  the 
claims  department  is  not  thought  to  require  underwriting  data  and  so  claims  personnel 
are  not  provided  with  underwriting  access  codes.     Medicare  and  Champus  personnel  each 
have  access  only  to  their  own  data  files. 

All  requests  for  information  not  covered  by  existing  rules  must  be  in  writing 
and  approved  personally  by  Kohanek,  a  requirement  that  he  feels  has  cut  down  the  number 
of  requests.     The  move  to  computers  by  itself  reduced  the  number  of  people  handling 
and  duplicating  files,  and  this,  too,  reduced  opportunities  for  unauthorized  access. 

Physical  security  for  the  computer  was  strengthened  in  I969  following  a  false 
bomb  threat.     Accounting  controls  over  the  huge  sums  of  money  involved  in  income 
premiums  and  outgoing  benefits  also  operate  to  prevent  unauthorized  access.     In  sum. 
Mutual  officials  believe  that  confidentiality  is  fostered  by  their  computer  security 
rules  and  procedures. 

The  company  stresses  confidentiality  to  its  agents  and  home  office  personnel. 
Training  materials  instruct  them  never  to  release  confidential  information  to 
unauthorized  people,  never  to  translate  the  codes  on  rejected  applications  for  anyone; 
and  never  to  discuss  confidential  information  with  applicants,  policyholders,  or 
physicians.    Every  three  or  four  months.  Mutual  distributes  a  bulletin  reminding 
employees  of  the  company's  confidentiality  rules.     According  to  Hansen,  Mutual  has 
never  had  any  problem  with  employees  divulging  confidential  information.  General 
Counsel  Muchemore  said  the  company  had  not  received  complaints  of  breaches  of 
confidentiality,  nor  had  it  been  sued  over  such  an  issue. 

3.  Policyholder  Access 

Policyowners  are  permitted  to  see  their  files  (including  data  secured  by 
inspection  reports)  so  long  as  they  furnish  proper  identification.     The  data  is 
given  only  in  person,  and  not  over  the  telephone.     However,  policyowners  will  be 
given  copies  from  their  files  only  of  statements  they  have  signed  (e.g.  the 
application  form)  and  the  bills  they  have  sent  to  the  company  for  payment;  other 
documents  especially  those  from  third  parties,  cannot  be  copied. 
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Mutual  believes  that  insurance  carriers  should  disclose  medical  information  not 
known  to  the  individual  only  to  a  personal  physician,  not  the  individual  directly. 
"This  will  come  closest  to  an  absolute  guarantee  that  such  information  will  be 
properly  explained,"  Dr.  Long  stated,  and  "the  possibility  of  arousing  feelings  of 
doubt,  fear,  anxiety,  or  anger  will  be  held  to  a  minimum."    Thus  when  Mutual  gets 
medical  information  from  a  hospital  or  physician  that  affects  its  underwriting 
decision,  and  if  the  applicant  asks  to  see  this.  Mutual  will  write  back  to  the 
hospital  or  doctor  and  call  on  them  to  explain  it  to  the  patient.     "We  don't 
want  to  interfere  with  the  doctor- patient  relationship,"  said  Dr.  Long. 

The  Fair  Credit  Reporting  Act  has  played  a  significant  role  in  expanding 
consumer  access  to  insurance  company  files,  including  Mutual *s.    As  noted  earlier, 
insurance  companies  must  notify  each  applicant  that  the  company  may  investigate  or 
verify  the  personal  information  supplied.     If  insurance  is  denied  on  the  basis  of  an 
inspection  by  a  Consumer  Reporting  Agency  (that  is,  one  of  the  outside  commercial 
firms  as  distinguished  from  Mutual's  ovm  investigating  staff),  the  insurance  compajiy 
must  give  the  applicant  or  policyovmer  the  name  of  the  company  making  the  report, 
and  he  may  then  go  there  to  find  out  its  content  and  take  further  action  if  he 
thinks  it  is  incorrect. 

Gene  Retz,  second  vice-president  for  underwriting  and  renewal,  says  that  Mutual 
receives  relatively  few  inquiries  or  complaints  under  this  law  -  generally  less  than 
five  a  week.     "To  the  best  of  my  knowledge,  we  haven't  needed  to  correct  any  action 
yet  on  the  basis  of  anything  turned  up  in  a  customer  inquiry,  though  we'd  be  glad  to 
if  we  found  out  that  there  had  been  some  mistake." 

'"Many  of  the  calls  we've  gotten,"  another  Mutual  official  noted,   "are  the  result 
of  the  notice  people  receive  informing  them  that  an  inspection  investigation  will  be 
completed.     They  want  to  know  who  we  will  ask,  what  the  topics  will  be  and  so  forth. 
We  certainly  don't  have  any  difficulty  replying  to  any  of  those  calls." 

For  its  work  in  Medicare,  Mutual  comes  under  the  federal  Privacy  Act  of  197^ 
(P.L.  93-579),  which  became  operative  in  September  of  1975.     Regulations  under  the  Act 
designate  carriers  and  intermedisuries  under  Medicsire  to  be  components  of  the  Bureau 
of  Health  Insurance  of  the  Social  Security  Administration.     This  requires  them  tot 

(1)  permit  an  individual  to  determine  what  records  pertaining  to  him 
are  collected,  used,  or  disseminated  by  such  agencies j 

(2)  permit  an  individual  to  prevent  agency  records  pertaining  to  him 
from  being  used  for  any  purpose  not  compatible  with  that  for  which 
obtained; 

(3)  permit  an  individual  to  gain  access  to  information  pertaining  to 
him  in  Federal  agency  records,  euid  to  correct  such  records  when 
appropriate . 

In  order  to  comply  with  the  requirements  of  the  Privacy  Act,  each  Medicare 
contractor  must: 

(1)  inform  each  individual  from  whom  information  is  requested  of  his  or 
her  rights  under  the  Privacy  Act; 

(2)  identify  pertinent  systems  of  records  to  be  described  in  the  Federal 
Register; 

(3)  describe  the  method  of  accessing  individual's  records; 

(4)  prepare  a  method  of  accounting  for  disclosures; 
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(5)  devise  a  method  of  reviewing  records  at  the  request  of  individuals 
and  making  corrections  if  appropriate. 

Mutual  has  instituted  these  procedures,  but  it  is  too  early  to  judge  what 
effects  the  Act  will  have  on  either  Medicare  claimant  behavior  or  the  underwriting 
and  claims  processes.     When  queried  in  March  of  1976,  Dr.  Robert  S.  Long,  Mutual's 
Associate  Medical  Director,  reported  that  the  company  had  received  few  if  any  Privacy 
Act  inquiries  under  either  Medicare  or  CHAMPUS.     There  was  some  concern  at  Mutual 
that  the  Act  might  cause  reporting  sources  to  "dry  up"  a  bit,  at  least  temporarily 
while  the  Act's  provisions  were  being  studied  and  experience  under  it  observed. 


Observations 

Mutual's  experiences  as  a  highly-automated  service  payer  indicate  that 
computerization  has  not  chemged  the  way  it  deals  with  citizen  rights.     Its  traditional 
policies  protecting  the  confidentiality  of  policy-holder  and  beneficiary  data  have 
been  reproduced  in  its  automated  systems.     Data  security  is  probably  enhanced  rather 
than  lessened  in  its  computerized  systems.     And  as  Congress  has  written  new  laws  to 
protect  citizen  rights,  Mutual  has  complied  as  fully  in  its  automated  as  its  majiual 
operations,  and  as  well  as  health  insurers  who  are  less  computerized. 

The  important  citizen  rights  issues  that  lie  ahead  for  firms  such  as  Mutual  are 
almost  entirely  issues  of  social  policy,  not  technology.     Will  Americaji  society  choose 
to  intervene  by  law  in  the  risk-selection  process  to  limit  the  criteria  that  may  be 
used  (and  the  investigations  made)  by  insurance  compajiies — as  with  sexual  preference, 
cultural  life  style,  and  racially-based  "objective"  health  conditions?    Will  society 
reject  Mutual's  stand  in  favor  of  revealing  sensitive  health  data  only  to  a  chosen 
medical  representative,  rather  than  the  individual  directly? 

For  the  first  of  these,  the  fact  that  Mutual  is  a  private  profit-making 
organization  is  important,  since  the  selection  of  risks  is  critical  to  competitive 
success,  and  private  firms  have  sometimes  been  allowed  to  continue  applying  criteria 
of  selection  that  government — bound  by  the  Bill  of  Rights — cajinot.     But  in  the  second 
area — patient  access — Mutual's  position  echoes  that  of  most  government  health 
professionals  and  agencies,  and  it  would  be  mistaken  to  apply  a  public-private 
distinction. 

Beyond  these  questions  lies  the  role  that  firms  such  as  Mutual  will  play  in 
any  future  system  of  national  health  insurance.     The  possibilities  range  from  their 
being  intermediaries  in  almost  the  same  fashion  as  Mutual  now  is  for  Medicare  and 
CHAMPUS  to  their  role  being  limited  to  the  offering  of  supplementary  insursmce  beyond 
a  basic,  population-wide,  government-administered  health  payment  plan.  Important 
citizen  rights  issues  will  be  involved  here,  and  we  will  return  to  this  theme  in  the 
report's  final  chapter. 
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SOURCES 


Part  of  this  profile  is  drawn  from  an  earlier  site  visit  to  Mutual  and  the 
resulting  profile  developed  by  the  Project  on  Computer  Databajiks  of  the  National 
Academy  of  Sciences'  Computer  Science  and  Engineering  Board,     This  was  published  in 
Westin,Alaii  F.and  Baker,  Michael  A.,  Databanks  in  a  Free  Society  (New  York: 
Quadrangle/The  New  York  Times  Book  Company  1972)  pages  143-15^-.    A  site  visit  for  this 
project  was  made  in  August  of  197^.  by  staff  member  Richard  Silberberg.  Thereafter, 
additional  written  materials,  letters,  and  telephone  interviews  were  developed  through 
March  10,  1976,  primarily  by  HeleneToiv  and  Alan  Westin. 

The  following  Mutual  officials  provided  interviews  used  in  the  writing  of  this 
profile:  Senior  Executive  Vice  President  Albert  Hansen;  Executive  Vice  President  for 
Government  Related  Programs  Charles  Hermanek;  Director  of  Medicare  Administration 
Ben  Patterson;  Assistant  Vice  President  for  Medicare  Administration  Richard  Bath; 
Assistant  Vice  President  for  CHAMPUS  John  Wrabetz;  General  Counsel  Robert  Muchemore ; 
Associate  Medical  Director  Kenneth  Fletcher;  Assistant  Vice  President  Len  Tondl; 
Associate  Medical  Director  Robert  Long;  Mr.  Thome  Dillon;  Mr.  James  Barrett;  Vice 
President  for  Computer  Systems  James  J.  Kohanek. 
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Part  Four 
Policy  Alternatives 
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CHAPTER  11.     ASSESSING  THE  COMPUTER'S  ir/:PACT  ON  CITIZEN  RIGHTS 


The  purpose  of  this  chapter  is  to  analyze  the  impact  of  health-data 
computerization  on  the  citizen      rights  identified  in  Part  One.     At  the  outset,  this 
requires  consideration  of  the  social  setting  in  which  such  computerization  has  been 
proceeding.     While  we  have  touched  on  some  of  these  themes  before,   in  the  survey  of 
manual  record-keeping  and  the  profiles,  it  is  important  to  pull  these  elements 
together  here,  for  they  represent  the  atmosphere  within  which  specific  incidents  need 
to  be  understood. 

THE  SOCIAL  SETTING  OF  HEALTH -DATA  COMPUTERIZATION 

The  Computer  Seen  As  An  Instrument  of  Continuing  Discrimination 

The  civil  rights  movement  gave  impetus  to  the  formation  of  many  groups  of 
disadvantaged  people  struggling  to  overcome  legal  and  social  disabilities.     In  addition 
to  blacks,  other  non-whites,  women,  and  political  dissidents,  these  groups  include 
diverse  sets  of  the  population  such  as  homosexuals,  ex-mental  patients,  individuals  in 
psychotherapy,  people  with  arrest  records,  the  physically  handicapped,  people  with 
stigmatized  diseases  (epileptics,  cerebral  palsied,  etc.),  women  who  have  had 
abortions,  and  ex  drug  or  alcohol  abusers. 

The  common  element  among  such  groups  is  their  claim  that  they  should  have  £in  equal 
competitive  opportunity  with  others  in  the  award  of  credit,  employment,  housing, 
education,  licensing,  and  government  benefits.     They  contend  that  using  their  special 
condition  to  block  access  to  these  opportunities  represents  a  reliance  on  irrelevant 
or  improper  criteria. 

On  the  whole,  the  trend  in  American  law  and  public  opinion  during  the  past  decade 
has  been  to  accept  the  justice  of  many  of  these  claims.     Indeed,  American  society  has 
already  modified  substantially  the  credential  system  that  operated  against  such  groups 
in  the  19^0 's  and  50 's. 

This  development  poses  some  sharp  problems  for  organizational  record-keeping. 
Once  society  has  formally  recognized  a  group's  right  to  equal  treatment,  and  sets  up 
enforcement  mechanisms    to  provide  affirmative  or  even  compensatory  action,  the 
recording  of  a  condition  is  generally  accepted  as  a  practical  necessity.     Thus  most 
women,  blacks,  and  other  racial  or  language  minorities,  whose  conditions  are  usually 
obvious,  do  not  raise  an  objection  on  the  basis  of  privacy  when  organizations  note 
and  record  their  statuses. 

For  other  disadvantaged  groups,  however,  those  who  have  not  yet  won  full  legal 
protection  of  their  equality  rights,  preventing  any  systematic  notation  of  their 
condition  is  a  prime  group  objective.     Sometimes,  where  their  condition  is  not 
immediately  noticeable,  the  objection  is  to  organizations  conducting  intrusive  personal 
investigations  or  forcing  self -disclosure  to  identify  these  matters.     Whether  it  is 
noticeable  or  not,  these  groups  lodge  a  "privacy  complaint"  against  the  recording  of 
this  information  because  they  know  it  will  be  used  to  restrict  their  rights  and 
opportunities.     The  demand  for  privacy  here  is  a  tactic  in  the  struggle  to  win  social 
acceptance  of  their  condition  as  immaterial  to  the  decisions  being  made. 
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Groups  challenging  discriminatory  data  collection  have  as  much  concern  with  manual 
records  as  with  computerized  data  systems  that  carry  forward  the  existing  standards. 
But  they  also  see  computerization  as  accelerating  discrimination  because  computerized 
data  systems  usually  involve  more  systematic  collection,  more  extensive  recording, 
more  centralization,  and  easier  dissemination.     Health  records  have  been  a  major  area 
of  such  group  protests  not  only  when  it  is  a  purported  "health  condition"  (being  in 
therapy, etc . )  that  produces  the  social  discrimination  but  also  when  the  social  data 
put  into  so  many  health  records  includes  political,  social,  racial,  sexual,  or  other 
criteria  that  are  then  used  to  make  important  "non-medical"  judgments  about  people. 

Growing  Skepticism  About  "Data-Based"  Government  Social  Programs 

The  profile  of  the  Indian  Health  Service  demonstrated  the  vital  role  that 
computers  can  play  in  collecting  the  data  needed  for  planning  socially  useful 
programs.     The  computer  records  on  the  Papago  Indians  generated  all  sorts  of 
statistical  studies  showing  the  relationship  between  poor  housing  and  poor  health; 
the  role  that  poor  nutrition  played  in  certain  diseases;  what  diseases  were  most 
prevalent;  what  special  medical  equipment  was  lacking,  etc.     But  while  the  computer 
continues  to  turn  out  these  studies,  the  housing  of  the  Indians  continues  to 
deteriorate,  the  disease  rate  continues  to  climb,  and  their  medical  needs  are  not 
being  met. 

The  gap  between  the  health  data  collected  by  computers  for  socially  useful 
programs  and  the  actual  delivery  of  such  prograjns  is  commonplace,  and  it  can  affect 
peoples*  views  of  the  utility  of  data  collection,  as  the  following  example  illustrates. 
About  ten  years  ago,  private  developers  and  the  District  of  Columbia  government 
undertook  a  slum  clearance  project  for  which  they  pledged  the  construction  of  enough 
low-cost  housing  so  that  the  original  residents  of  the  neighborhood  would  not  be 
displaced.    As  a  first  step,  they  initiated  an  elaborate  study  of  the  housing, 
transportation,  schooling  and  medical  needs  of  the  residents,  in  which  extensive 
personal  information  on  welfare  status,  income,  and  health  history  was  gathered  and 
computerized  to  form  a  comprehensive  picture  of  the  neighborhood.     In  the  end,  however, 
only  middle  ajid  upper  middle  class  housing  was  built  and  virtually  all  the  long  time 
residents  were  displaced.     With  this  background,  the  announcement  in  1974  that  the 
District  government  would  renovate  Kennedy  stadium  and  as  part  of  that  renovation  would 
replace  the  slums  surrounding  the  stadium  with  low  cost  housing  was  greeted  with  some 
skepticism.     When  a  comprehensive  neighborhood  study  was  initiated,  local  leaders  urged 
the  residents  not  to  answer  the  questionnaires  because,  they  said,  the  housing  will 
never  be  built  and  the  studies  are  just  an  excuse  to  collect  personal  information  and 
that  nobody  knows  how  it  will  be  used.     In  December,  1975i  the  city  announced  that 
while  the  renovation  of  the  stadium  would  go  forward,  there  were  no  funds  available 
for  the  surrounding  new  housing. 

The  gulf  between  data  collection  and  program  fulfillment  is  especially  striking 
in  the  federal  government  because  ,  as  an  employer,  it  sets  standards  for  private 
employers.     Several  years  ago,  the  Department  of  Housing  and  Urban  Development 
announced  an  affirmative  action  plan  for  increasing  the  number  of  its  physically 
handicapped  workers.     It  took  a  census  of  the  number  of  physically  handicapped  at  the 
agency  and  then  set  a  recruitment  schedule  and  final  quota.     While  the  plan  was 
being  implemented,  the  new  HUD  building  was  being  built — being  built  without  the 
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ramps,  electric  eye  doors,  special  parking  facilities  and  other  features  that  would 
make  it  possible  for  handicapped  people  to  work  them.     Ultimately  the  protests  of  HUD 
employees,  wide  publicity,  and  the  threat  of  a  lawsuit  forced  HUD,  reluctantly, 
belatedly,  and  at  great  expense,  to  install  these  special  features. 

These  examples  would  belong  only  in  a  study  of  government  planning  and  service- 
delivery  were  it  not  for  the  fact  that  large  numbers  of  citizens  are  being  asked  in 
these  programs  to  disclose  personal  information  in  order  to  help  government  make 
"rational"  decisions.     It  should  not  be  a  surprise  to  government  officials  that  when 
such  "rational"  enterprises  fail  to  behave  rationally — that  is,  to  do  what  their 
announced  objectives  declare — citizens  will  become  increasingly  disbelieving  of  the 
promises  under  which  they  are  being  asked  to  reveal  personal  data. 

General  Distrust  of  Government  and  the  Watergate  Fallout 

If  we  were  living  at  a  time  of  high  citizen  respect  for  government  and  social 
institutions,  disbelief  about  government  promises  might  be  regarded  as  a  minor  issue. 
Government  officials  would  generally  be  trusted  not  to  misuse  the  sensitive  personal 
data  they  had  acquired,  and  the  problem  involved  would  be  the  costs  of  having 
collected  and  stored  all  that  personal  data  without  it  being  effectively  used. 

Trust  in  government,  however,  has  never  been  a  staple  of  the  American  political 
system.     Based  on  the  Founding  Father's  classically-grounded  fears  about  inevitable 
misuse  of  government  power,  our  system  rested  its  faith  on  constitutional  limits  to 
government  authority,  public  exposure  of  government's  affairs,  and  Bill  of  Rights 
protections  for  individual  and  associational  liberties. 

The  years  from  1932  to  1968,   broadly  viewed,  produced  a  great  enlargement  in  the 
American  public's  acceptance  of  government  authority.     This  grew  out  of  well- 
known  developments — the  need  to  end  the  Great  Depression,  install  major  social 
programs  to  help  the  needy,  wage  the  Second  World  War  atnd  then  the  Cold  War,  carry 
out  the  Great  Society  programs  of  the  60's,  and  provide  affirmative  support  to  the 
race  and  sex  equality  revolutions.     Most  conservatives  accepted  those  parts  of 
expanding  government  that  supported  business,  defense,  and  overseas  activity,  while 
most  liberals  were  enthusiastic  about  the  new  social  programs,  with  each  expressing 
reservations  over  the  other's  basis  for  supporting  enlarged  government  roles. 

However,  since  the  late  1960's  there  has  been  a  visibly  growing  public  discontent 
with  and  distrust  of  government  in  the  United  States,  a  sentiment  well  documented 
by  careful  opinion  surveys.     Conservative  critics  have  attacked  centralized  Big 
Government,  urging  a  return  of  funds  and  decision-making  to  the  state  and  local  levels 
as  well  as  using  private  rather  than  public  programs  wherever  possible.     Many  liberals 
have  become  disillusioned  with  the  failures  of  recent  government  programs  to  have 
fundamental  effects  on  poverty,  crime,  bad  education,  drug  rehabilitation,  race 
inequitites,  and  similar  problems.     Within  both  ideological  camps,  the  shortage  of 
viable  government  programs  has  also  led  to  doubts  about  using  legal  coersion  to 
collect  and  store  extensive  personal  information,  especially  from  "client  population" 
— senior  citizens  on  Social  Security  and  Medicare;  welfare  recipients;  children; 
persons  in  drug  rehabilitation  programs,  etc. 

All  of  this  might  have  still  remained  at  "normal"  levels  of  American  distrust 
about  governm.ent  had  it  not  been  for  Watergate  and  its  successor  revelations.  The 
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Watergate  disclosures  of  how  top  officials  of  the  federal  executive  branch  abused 
Internal  Revenue  Service  records,  conducted  mail  covers  and  openings,  used  illegal 
wiretapping  and  bugging,  spied  on  political  critics  and  dissident  groups,  and 
resorted  to  burglaries  and  break-ins  came  as  a  shock  to  the  American  public.     All  the 
"what  if"  warnings  of  civil  libertarians  about  possible  misuse  of  government  powers 
suddenly  became  real  rather  than  hypothetical  situations.     As  several  leaders  in  the 
psychiatric  profession  stated  recently,  "The  break-in  at  Dr.  Fielding's  office  to 
secure  Daniel  Ellsberg's  psychiatric  records  was  the  last  straw  for  us.     From  then  on, 
we  had  to  make  protection  of  confidential  records  a  top  priority  of  our  profession." 

Revelations  since  the  Watergate  disclosures  of  1973-7^  have,  if  anything,  deepened 
public  concern  over  the  security  of  personal  data  from  misuse.     During  197^-76, 
documentation  of  admittedly  illegal  or  improper  surveillance  activities  by  the  FBI, 
CIA,  and  IRS  have  convinced  the  average  person  that  the  label  of  "confidential"  on 
any  personal  file  held  in  government  may  be  slender  insurance  against  the  efforts  of 
federal,  state  or  local  investigators  to  get  information,  either  overtly  through  the 
"buddy  system"  or  by  covert  means. 

Thus  the  call  for  personal  data  to  carry  out  even  the  most  laudatory  government 
programs,  managed  by  even  the  most  socially-minded  and  confidentiality-oriented 
professionals,  must  bear  the  burden  now  of  the  Watergate  and  post-Watergate  revelations. 
If  this  seems  unfair  to  those  government  officials  or  proponents  of  social  programs 
who  were  wholly  outraged  by  Watergate,  such  are  likely  to  be,  for  some  time,  the 
painful  consequences  when  the  highest  elected  and  appointed  officials  in  a  nation  are 
found  to  have  betrayed  the  public  trust. 

Consumerism  Enters  the  Health  Care  Field 

Consumerism  as  a  movement  rests  on  two  basic  premises:  that  people  have  a  right 
to  be  truthfully  and  fully  informed  about  the  products  and  services  offered  for  sale 
to  them^ and  that  law  should  step  in  whenever  commercial  products  or  government 
activities  present  a  danger  to  public  health  and  safety.     Consumerism  has  joined  hands 
with  the  civil  rights  movement  over  denial  of  credit  or  other  commercial  services  to 
racial  minorities  or  women,  and  it  has  found  common  cause  with  civil  liberties  groups 
over  protection  of  confidentiality  and  rights  of  access  in  areas  such  as  credit 
reporting,  customer  bank  records,  and  school  and  college  files.    Medical  records  have 
often  been  part  of  these  consumer/citizen  rights  campaigns,  as  with  provisions  dealing 
with  medical  records  in  the  Buckley  Amendment  of  197^,  the  federal  Privacy  Act  of  197^ 
and  parallel  state  fair  information  practices  laws,  and  proposed  amendments  to  add 
medical  information  in  consumer  reports  to  the  coverage  of  the  Fair  Credit  Reporting 
Act. 

The  most  common  meeting  ground  for  consumerists  and  civil  libertarians  is  the 
demand  for  individual  access  to  records.     Using  medical  records  as  an  example,  the 
interests  are  common  when  the  issue  is  the  right  of  a  patient,  when  he  or  she  insists 
upon  it,  to  examine  the  primary  medical  record  and  to  know  about  any  other  uses  made 
of  it.     The  consumer's  demand  to  know  in  order  to  make  an  informed  "buyer's"  decision 
about  the  nature,  quality,  and  consequences  of  health  care  matches  the  civil 
libertarian's  insistence  that  access  is  vital  to  informed  consent  in  the  doctor-patient 
relationship  and  the  securing  of  due  process  whenever  an  individual's  secular  rights 
or  opportunities  are  determined  through  use  of  medical  information. 
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The  Uncertainty  of  Law 

As  we  noted  in  Part  One,  legal  rules  until  recently  have  not  been  very  clear  and 
detailed  on  the  key  issues  of  privacy,  confidentiality,  and  individual  access  raised 
by  the  growing  use  of  health  data  in  American  society.     Until  the  early  1970's,  case 
law  centered  primarily  on  issues  of  testimonial  privilege,  and  provisions  for  patient 
access  usually  arose  only  when  malpractice  actions  were  involved.     Many  statutes 
stipulated  that  medical  or  health  data  collected  under  their  auspices  were 
"confidential"  but  most  did  not  specify  what  that  promise  meant,  especially  in  terms 
of  controlling  the  release  of  identified  records  to  third  parties  for  quality-care 
review,  research,  for  law  enforcement,  under  subpoena,  etc.     There  were  virtually  no 
statutes  or  court  decisions  setting  limits  as  to  what  medical  data  could  be  collected, 
or  regulating  which  health  data  were  proper  and  improper  to  use  for  making  governmental 
and  social  judgments. 

This  situation  began  to  change  in  the  mid-1970 's.    Federal  confidentiality 
statutes  governing  alcohol  and  drug  abuse  programs  provided  some  detailed  protections. 
The  federal  Privacy  Act  of  197^  and  its  counterpart  in  five  states  as  of  early  I976 
provided  important  rules  as  to  collection,  use,  and  individual  access  to  personal  data 
in  the  hands  of  government  agencies  providing  direct  health  care,  conducting  health 
research,  or  using  health  data  to  make  evaluative  decisions  for  employment,  licensing, 
etc.     Similarly,  HEW's  regulations  governing  confidentiality  and  access  in  the  new 
federal  PSRO  system  were  more  explicit  and  protective  than  anything  in  earlier 
federal  review  procedures. 

Several  things  should  be  noted  about  this  situation.    First,  many  of  the  reactions 
to  computerization  of  health  data  that  we  encountered  and  will  analyze  in  this  chapter 
took  place  before  such  new  privacy  laws    had  been  enacted:  they  arose  under  the 
then-correct  assumption  by  critics  that  there  was  no  existing  legislation  to  protect 
individual  rights  in  the  operations  of  such  data  systems.     A  second  point  is  that  the 
laws  just  mentioned  are  still  new  (the  federal  Privacy  Act  did  not  go  into  effect 
until  September  of  1975)  and  their  effects  are  still  uncertain;     this  is  all  the 
more  true  for  the  health  field  because  these  acts  do  not  contain  specific  sections 
written  to  deal  with  the  special  problems  of  medical  and  health  records.  Finally, 
the  entire  private  sector  and  4 5  of  the  states  are  not  covered  by  general  privacy 
legislation,  leaving  quite  a  gap  in  the  structure  of  citizen  protection. 

Thus  the  first  major  encounters  by  health  professionals  and  citizen  rights  groups 
with  computerizing  health-data  systems  airose  either  before  basic  legal  rights  of 
patients  and  data  subjects  had  been  spelled  out,  or  at  a  time  when  coverage  of  these 
acts  for  patient  rights  is  still  far  from  clear.    As  a  result,  various  groups 
concerned  over  citizens  rights  have  remained  distinctly  uneasy  about  accepting 
computerization  of  sensitive  health  data  before  rules  and  safeguards  are  fully 
installed. 

Popular  Perceptions  of  "The  Computer" 

When  computers  began  to  be  used  extensively  in  the  mid-1960 's  to  automate 
personal  data  files,  much  of  the  American  public  was  fundamentally  ignorant  of  what 
computers  did  and  how.     As  a  result  of  over-inflated  claims  of  capability  by 
computer  enthusiasts  and  over-credulous  acceptance  of  these  predictions  by  persons 
worried  about  citizen      rights,  much  of  the  debate  over  "computers  and  privacy" 
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in  the  late  1960's  was  based  on  faulty  assumptions  as  to  the  computer's  real  impact 
on  data  handling  sind  decision-making. 

This  condition  was  rectified  by  the  report  of  the  National  Academy  of  Sciences' 
Project  on  Computer  Databanks  in  1972.     The  NAS  study,  to  which  we  have  already 
referred,  explained  and  corrected  several  popular  misconceptions  about  computers. 
It  showed  that  computer  use  did  not  automatically  lead  organizations  to  collect  more 
intrusive  information  than  they  had  collected  manually;  or  to  exchange  data  with 
different  orgemizations  than  had  been  traditional,   just  because  each  had  computers; 
or  to  be  more  secretive  and  provide  fewer  notice  and  access  rights  than  the  same 
organization  did  before  it  computerized.     The  NAS  Report  also  showed  that  computers 
always  respond  to  the  explicit  instructions  of  their  owners  as  to  how  long  to  store 
any  piece  of  information,  what  significance  to  place  on  any  item,  or  what  factors 
to  aggregate  in  making  a  judgment  about  any  person.     In  short,  computers  were  shown 
to  follow  the  policy  directions  of  human  owners  and  programmers  as  set  by 
organizational  managers  or  by  law;  they  are  not  the  "unforgiving,  unf orgetting" 
automatons    presented  by  much  of  the  anti-computer  literature  of  the  1960's. 

The  NAS  Report  and  other  objective  studies  led  most  citizen  groups,  professional 
organizations,  and  political  leaders  in  the  mid-1970 's  to  focus  on  the  real  citizen 
rights  issues  in  record-keeping:  whatever  the  medium  of  information  storage  and 
processing,  what  are  the  standards  and  procedures  being  adopted  by  organizational 
managers  to  make  judgments  about  people?    Opinion  studies  also  showed  that  a 
majority  of  the  public  had  acquired  sensible  judgments  about  many  key  issues  of 
computerization,  for  example,  that  most  of  the  goofs  and  rigidities  of  computer 
operations  are  the  result  of  insensitive  human  actions,  which  can  be  remedied  at 
acceptable  costs  if  the  public  refuses  to  accept  such  performances.     Passage  of  the 
Fair  Credit  Billing  Act  of  1975  is  an  example  of  the  public's  determination  that 
computer  systems  should  be  made  responsive  to  people,  and  not  vice  versa. 

The  importance  of  this  for  our  purposes  is  that  extensive  computer  use  in  health 
care  arrived  in  the  I970's,  after  citizen  rights  groups,  the  media,  and  legislators 
had  begun  to  acquire  more  sophisticated  and  accurate  views  of  what  computers  can 
and  cannot  do.     It  also  came  after  the  public  had  shown  that  it  accepted  the 
"privacy  campaign"  as  a  legitimate  and  important  area  for  regulatory  action. 

*■)(•* 

Other  forces  and  trends  might  be  mentioned  in  describing  the  complex  social 
setting  in  which  health  computerization  is  taking  place,  and  we  have  not  tried  to 
assemble  here  a  comprehensive  account.     Our  goal  has  been  to  note  these  developments 
that  bear  directly  on  citizens  rights  claims,  and  on  that  score,  we  think  the  major 
points  have  been  made.     Computerization  of  health  data  is  imfolding  in  axi  atmosphere 
of  considerable  public  mistrust  over  the  motives,  promises,  practices,  and 
performemce  of  government  agencies,  mixed  with  a  rapidly  growing  consumerist  approach 
to  health  care  and  growing  public  belief  that  privacy  protections  should  be  instituted 
by  positive  regulation  before  sensitive  new  data  systems  are  implemented. 
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ANALYZING  THE  COMPUTER'S  IMPACT 


Given  the  social  setting  that  we  have  described,  how  can  we  analyze  the  impact 
that  health-data  computerization  has  had  thus  far  on  citizen    rights?    One  important 
observation  to  start  with  is  that  instances  of  harm,  done  to  individuals — violations 
of  confidentiality,  refusals  of  access,  etc. — are  still  almost  entirely  centered  today 
on  manual  rather  than  computerized  files.     This  is  because  manual  files  are  the 
places  where  most  of  our  detailed  medical  and  health  records  are  still  being  kept. 
Furthermore,  even  when  some  patient  records  are  automated  by  Zone  I  providers,  there 
is  usually  manual-record  backup,  photocopies,  or  computer  printout  floating  around 
somewhere  in  the  organization,  and  this  remains  an  easier  target  for  attack,  as  by 
reporters  trying  to  get  information  on  celebrities  in  hospitals,  than  are  the  computer 
files.     Where  record  systems  have  been  heavily  computerized,  as  in  the  service  payer 
organizations  in  Zone  II,  the  complaints  that  we  noted  have  also  arisen  primarily 
from  employees  of  payer  organizations  writing  doctors  and  hospitals  to  provide  more 
detailed  (manual)  information  than  the  providers  thought  necessary  and  proper,  or  when 
leaks  of  patient  data  were  made  in  manual  reports  to  employers  about  their  employees' 
health  conditions.     Similarly,  most  of  the  disputed  social  judgments  about  people  being 
made  by  organizations  in  Zone  III,  on  the  basis  of  health  data,  are  also  still  based 
today  on  manual  records. 

Secondly,  as  we  examined  automation  of  health  data  in  Zones  I  aind  II,  we  noted 
that  records  in  their  computer  files  are  generally  more  subject  to  rules  of  restricted 
access  than  paper  records  located  elsewhere  in  that  institution  or  in  similar 
non-automated  facilities.     Partly,  this  is  because  protection  of  the  computer,  its 
programs,  and  its  continuous  operations  leads  to  stricter  rules  than  are  usually 
followed  at  nursing  stations,  record  rooms,  etc.;  in  this  sense,  privacy  and 
confidentiality  are  serendipitous  beneficiaries  of  computer  security  practices. 
However,  we  also  noted  that  many  of  the  computer  professionals  and  medical  or  health 
colleagues  who  lead  computerization  projects  in  the  health  field  are  sensitive  to  the 
civil  liberties  issues,  since  these  have  been  so  widely  debated  in  the  computer  press 
over  the  past  half  dozen  years.     In  addition,  a  set  of  general  systems  techniques  for 
controlling  authorizations  and  access,  maintaining  audit  trails,  and  taking 
protective  measures  over  personal  or  proprietary  data  have  been  evolved  and  well 
publicized  in  the  past  few  years,  and  these  have  been  installed  in  many  of  the  systems 
that  we  visited  or  studied.     Thus,  making  a  gross  comparison  as  to  the  degree  of 
protection  given  to  confidential  patient  data  in  most  highly  automated  systems 
compared  to  most  comparable  manual  facilities,  our  judgment  would  be  that  the  automated 
facilities  are  better  protected  today  than  most  manual  records  against  the  kind  of 
leakages  and  misuses  that  have  been  problems  in  recent  decades. 

What  we  conclude  is  that  the  main  problem  today  in  computerized  health  data 
systems  is  potential  harm.    As  we  will  see,  what  makes  such  potential  harm  particularly 
serious  for  civil  liberties  is  the  fact  that  these  possibilities  of  misuse  have  not 
been  taken  into  account  and  dealt  with  effectively  by  the  managers  of  such 
computerized  systems. 
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To  develop  this  analysis,  we  will  present  a  series  of  incidents  ,  collected  dur- 
ing the  two  years  of  this  project,  involving  the  creation  or  use  of  computerized 
records.     We  will  relate  what  happened,  sometimes  grouping  several  situations 
together,  then  offer  comments  on  what  the  incidents  suggest  about  computerization 
and  citizen  rights. 

1 

Incident;  The  Missouri  State  Division  of  Health 

In  June  of  197^,  the  State  of  Missouri's  Division  of  Health  ordered  all  Missouri 
hospitals,  private  as  well  as  public,  to  provide  abstracts  of  patient  discharge  data 
so  that  state  health  officials  could  "study  the  prevalence  and  control  of  disease  in 
Missouri."    The  abstracts  were  to  include:  an  abstract  number;  hospital  number; 
medical  record  number;  year  and  date  of  birth;  admission  data;  dischairge  date;  sexj 
race,  color,  or  origin;  marital  status;  residence  (by  census  tract,    zip  code  and 
street  name);  discharge  service;  expected  primary  source  of  payment;  attending 
physician;  discharge  status;  diagnosis;  and  surgical  and  diagnostic  procedures  used. 
Providing  the  patient's  name  was  "optional"  for  the  hospital.     Failure  to  provide 
the  abstract  could  lead  to  loss  of  the  hospital's  license  to  operate. 

The  availability  of  computers  was  officially  cited  as  the  reason  for  launching 
the  mandatory  data  system  in  197^.     Garland  Land,  director  of  the  Missouri  Center  for 
Health  Statistics,  explained  that  "the  program  has  actually  been  in  effect  since 
1963  on  a  voluntary  basis.     When  the  program  was  computerized  to  make  it  more 
efficient,  100  per  cent  of  the  data  was  necessary  and  its  release  was  made  mandatory." 
In  addition  to  helping  in  the  study  and  control  of  disease,  state  authorities  said 
the  information  was  vitally  needed  for  better  health  planning  and  to  avoid  the 
construction  of  unnecessary  or  duplicative  hospital  facilities. 

These  explemations ,  and  the  way  the  new  system  was  to  operate,  did  not  convince 
everyone  in  Missouri.     St.  Mary's  Hospital  in  Richmond  Heights,  Missouri,  announced 
that  it  would  refuse  to  supply  the  discharge  data.     Patient  authorization  is  required 
for  all  information  released,  St.  Mary's  said,  and  government  agencies  can  be  given 
only  aggregate  data  in  the  form  of  statistics.    Robert  Thebeau,  assistant  executive 
director  of  St.  Mary's  explained  that  while  the  stated  objectives  of  the  state 
program  "sound  good,"  the  way  the  state  went  about  these  is  "not  sound."    All  the 
state  needs  is  statistical  data,  he  declared,   "but  they  want  information  about  each 
patient. " 

Director  Land  replied  that  statistical  data  "isn't  refined  enough  and  presents 
limitations.     Individualized  data  are  needed  because  they  are  more  easily  analyzed. 
But  this  doesn't  mean  the  data  have  to  be  personally  identifiable.     We  don't  ask  for 
patients'  names."    State  officials  also  noted  that  the  June  197^  directive  made 
provision  for  protecting  patient  privacy.    A  clause  in  the  collection  order  stated: 
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"Any  contemplated  dissemination  by  the  Missouri  Division  of  Health  of  the  data 
orii2:inally  procured  from  a  hospital  and  which  contains  evidence  which  might  identify 
any  individual  person,  hospital  or  physician  can  be  carried  out  only  with  written 
permission  of  the  hospital." 

These  assurances  still  did  not  satisfy  officials  of  the  Sisters  of  St.  Mary's. 
Rosalie  Merz,  medical  records  administrator,  said  that  once  patient  information  is 
given  to  the  state  "there  is  no  way  we  know  it  can  be  secure.  There  is  no  foolproof 
data  processing  storage  system."  Mr.  Thebeau  added  that  Missouri's  "Sunshine  Law" 
opens  all  state  information  not  expressly  exempted  to  public  access,  and  there  was 
no  assurance  that  these  records  were  exempt. 

To  deal  with  the  threat  they  saw  posed  by  the  state  data  system,  St.  Mary's 
officials  helped  form  the  Eastern  Missouri  Task  Force  for  Health  Data  Security,  a 
group  composed  of  hospital  executives,  medical  record  administrators,  physicians, 
nurses,  computer  programmers,  and  systems  analysts  working  in  the  hospital  field.  In 
its  communication  with  the  state  health  division,  the  Task  Force  stressed  that  it 
"does  not  question  the  need  for  comparable  health  data."    However,   "as  a  matter  of 
professional  ethics,"  Task  Force  members  said,   "we  cannot  submit  clinical  data  to 
this  data  bank,   or  any  other  data  bank,  until  we  have  been  assured  that  adequate 
safeguards  have  been  built  into  the  system."    In  addition  to  asking  that  protective 
rules  be  spelled  out  dealing  with  confidentiality  and  data  security  in  the  proposed 
system,  the  Task  Force  suggested  that  such  data  ought  to  be  maintained  in  special 
Ethical  Data  Centers,  a  new  set  of  institutions  operating  under  formal  codes  of 
professional  conduct,   "with  explicit  and  appropriate  operati^onal  standards,  with 
clearly  defined  data  access  policies,  and  with  stringent  and  continuing  data  security 
measures  to  ensure  medical  confidentiality."  (The  Ethical  Data  Center  concept  has 
been  pioneered  by  Dr.  Elmer  Gabriel!  of  the  E.J.  Meyer  Hospital,  Buffalo,  New  York.) 

By  June  of  197^,  leaders  of  the  St.  Louis  County  Medical  Society  had  joined  in 

the  opposition  to  the  state's  data  plan.     The  Society's  "Legislative  Column,"  written 

by  Dr.  Edwin  J.  Cunningham,  noted  that  the  items  of  patient  identification  to  be 

collected,  even  though  they  did  not  include  name,  would  be  enough  to  make 

identification  of  individuals  "a  simple  matter."     "In  addition,  the  attending  physician 

would  have  an  identifiable  number  that  would  easily  identify  him  and  gain  access  to 

confidential  information."    Dr.  Cunningham  went  on  to  report: 

The  Ad  Hoc  Committee  of  the  County  Society  regarding  PSRO  discussed 
this  proposal  in  detail  with  several  other  guests  recently.     It  was  the 
feeling  of  the  committee  that  since  the  need  for  this  information  and  the 
authority  to  acquire  it  has  not  been  clearly  established,  that  we  oppose 
such  a  proposal  at  this  point.     In  addition,  the  utilization,  distribution, 
and  access  to  this  confidential  information  is  also  unclear  which  poses  a 
severe  threat  to  confidentiality. . . . 

Any  legitimate  data  requested  by  the  Missouri  State  Health  Department 
can  be  met  by  currently  operative  mechanisms  that  insure  that  confidentiality 
is  preserved. 

In  addition.  Dr.  Robert  Deitchman  wrote  a  scathing  attack  in  the  Medical  Society 

Bulletin  calling  on  doctors  to  rally  the  public  against  the  state's  proposal: 

Confidentiality — one  of  the  keystones  to  the  patient-doctor  relationship 
will  become  a  hollow  word — a  farce — if  the  state  health  organization 
continues  with  its  on-going  plans  to  computerize  all  discharge  information 
from  the  hospitals.... 


220 


Despite  crude  and  sparse  material  requested,  a  person  with  some  knowledge 
can  sift  through  the  computer,  checking  out  a  specific  person,  pinning  him 
down  by  age,  address,  date  or  discharge,  and  census  block,  to  pinpoint  ajiy 
individual  they  see — and  use  it  as  they  wish — regardless  of  today's  promise 
it  will  all  be  done  in  desire  for  research  and  statistics.... 

For  the  doctor  this  is  a  real  threat  to  his  oath  as  a  doctor — but  the 
public — they  need  to  be  warned,  alerted,  awakened  to  the  silent  death  of 
their  privacy  amid  the  slowly  turning  hum  of  the  computer  and  bureaucracy. 

As  opposition  mounted,  the  Task  Force  directed  another  attack  on  the  failure  of 
the  state  health  division  to  involve  the  medical  profession,  the  bar,  and  computer 
experts  before  it  ordered  the  project  to  proceed. 

In  November  of  197^,  the  Attorney  General  of  Missouri  was  asked  to  rule  on  the 
legality  of  the  state  division  order.     Before  he  could  do  so,  however,  the  state 
health  division  announced  in  December  of  197^  that  it  had  reconsidered  its  order. 
The  provision  of  discharge  abstracts,  it  said,   "will  continue  to  be  voluntary." 

Comment 

This  episode  contains  several  different  elements  typical  of  those  that  arise 
along  with  computerization:     (1)  the  change  from  voluntary  to  mandatory  compliance 
was  dictated  because  the  computer  made  processing  of  the  information  possible; 
(2)  the  need  for  the  computerization  of  identified  patient  data  for  the  purpose  of 
hospital  planning,  evaluation  and  utilization  review  was  not  balanced  convincingly 
against  the  rights  of  confidentiality  of  the  patients;     critics  pointed  out  that 
the  same  socially  useful  goals  could  be  carried  out  with  unidentified  statistical 
data;  (3)  the  proposal  to  computerize  identified  data  was  not  accompanied  by  any 
plan,  draft  legislation,  or  regulation  to  prevent  dissemination  of  identified  data; 
a  mere  pledge  that  dissemination  of  patient  information  would  require  permission  of 
the  hospital  raised  more  questions  than  it  answered,  and  no  attempt  was  made  to  secure 
legal  protection  of  the  records  from  the  operations  of  Missouri's  public  information; 
{^■)     special  concerns  were  raised  because  of  the  possibility  that  once  the  data  was 
in  the  state  health  divisions'  computer  files,  it  might  be  sought  by  other  state 
health  or  welfare  agencies  with  automated  systems,  or  be  demanded  by  federal  officials 
administering  federal  health  programs. 

Several  markedly  similar  incidents  have  occurred  in  other  states;  we  will  look  at 
three  together. 

2 

Incident;  The  Michigan  Department  of  Mental  Health 

In  the  fall  of  1972,  Dr.  E.  Gordon  Yudashkin,  Director  of  the  Michigan  Department 
of  Mental  Health,  announced  that  a  detailed  "face  sheet"  report  would  be  required  on 
all  persons  being  treated  by  local  mental  health  agencies  as  a  condition  of  continued 
state  funding  of  their  activities.     These  would  go  into  a  state  computer  file,  where 
they  would  be  used,  Dr.  Yudashkin  stated,   "to  evaluate  whether  the  poor  and  the 
really  sick  are  being  helped"  and  to  facilitate  the  treatment  of  more  people  outside 
institutions.     Opposition  to  the  compulsory  reports  was  immediately  voiced  by  mental 
health  agencies  and  the  state  ACLU  chapter.    A  lawsuit  in  state  court  to  enjoin  the 
program  was  filed  by  the  Michigan  Society  for  Mental  Health  and  the  Shiawassee 
Community  Health  Board,  alleging  that  disclosure  of  extensive  personal  and  diagnostic 
information,  stored  by  name,  violated  doctor-patient  confidentiality  and  improperly 
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invaded  the  patient's  privacy. 

Dr.  Yudashkin  replied  that  "the  new  system  gives  more  privacy  than  the  old  one," 
under  which  Michigan's  50  state  clinics  had  kept  records  by  patient  name  for  over  30 
years.     Under  the  plan  to  computerize  data  from  the  county    mental  health  group,  a 
"name  code"  is  used  based  on  every  other  letter  of  the  name,  and  this  protects 
confidentiality. 

The  complaining  groups  were  not  convinced  that  requiring  the  name  was  necessary 
for  the  state's  evaluative  needs,  or  that  using  the  code  procedure  was  a  sufficient 
safeguard . 

The  initial  court  decision  upheld  the  state,  but  while  an  appeal  was  being 
prepared,  Dr.  Yudashkin  announced  that  the  state  could  do  its  work  well  enough  without 
names  being  furnished  with  face  sheets  and  that  he  was  rescinding  the  requirement  for 
furnishing  names. 

Incident;  The  Washington  Department  of  Social  and  Health  Services. 

In  the  state  of  Washington  in  1972,  the  ACLU  had  prepared  the  papers  for  a  lawsuit 
against  the  King  County  (Seattle)  Community  Mental  Health  Service,  to  enjoin  its 
director  from  furnishing  the  state's  Department  of  Social  and  Health  Services  with 
identified  patient  case  information.     The  state  had  ordered  that  this  information  be 
furnished  by  all  private  and  community  institutions  receiving  state  or  federal  funds 
through  the  county  mental  health  service.     The  plan  was  to  create  a  central  computer 
file  in  the  state  capitol,  as  part  of  the  Department's  Community  Mental  Health 
Information  System. 

The  data  that  was  to  be  furnished  included  identification  information  (social 
security  number,   birthdate,  sex,  marital  status,  ethnic  origin,  monthly  family  income, 
etc.);  the  diagnosis  (by  the  American  Psychiatric  Association's  diagnosis  code);  the 
type  of  activity  used  as  therapy  or  treatment;  who  referred  the  person  or  group  there; 
an  evaluation  of  the  problems  the  individual  has  with  respect  to  job,  school,  home, 
family,  thought  process,  emotion,  marital,  drug,  or  alcohol;  and  an  identification  by 
name  and  discipline  of  who  made  the  diagnosis  eond  evaluation.     An  additional  report 
was  to  be  required  for  each  further  contact  with  the  center  or  agency  after  the  initial 
report . 

The  ACLU  suit  against  the  plan  was  brought  by  two  psychiatrists  working  on  a 
contract  basis  with  local  mental  health  centers  and  by  the  director  of  the  Jewish 
Family  and  Child  Service,  alleging  that  compliance  would  require  them  to  violate  the 
rights  to  privacy  and  medical  confidentiality  of  their  patients.     The  suit  called  on 
the  state  to  "devise  a  data  system  where  records  cannot  be  ascribed  to  individual 
patients . " 

Before  the  suit  was  filed,  an  agreement  was  worked  out  with  the  state  Attorney 
General  providing  that  more  limited  statistical  data,  and  without  personal  identifiers, 
would  be  all  that  local  agencies  had  to  submit  to  the  state. 

Incident!  The  New  York  State  Department  of  Mental  Hygiene 

No  such  negotiated  settlement  has  been  reached  in  a  case  currently  being  litigated 
in  New  York.     In  November  of  1973 t  the  state  Department  of  Mental  Hygiene  promulgated  a 
reporting  form  (known  as  the  "MS-5")  to  be  completed  on  each  psychiatric  outpatient  by 
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mental  health  Institutions  and  sent  to  Albany,  where  its  contents  would  be  placed  in 
the  Department's  computer  system.     The  MS-5  includes  the  patient's  name,  social 
security  number,  extensive  personal  information,  problem  appraisal,  problem  severity 
rating,  and  other  sensitive  data.     These  include:   "social  relations  disturbance," 
"social  performance  disturbajice , "  and  a  list  of  2k  "other  signs  and  symptcwna"  such  as 
"suicidal  thoughts,"  "grandiosity,"  "sexual  problems,"  "anti-social  attitudes," 
"narcotics,"  and  "delusions." 

The  Mental  Health  Law  Project  was  approached  in  late  1973  by  several  doctors  and 
patients  at  the  Tremont  Crisis  Center  of  Bronx  Hospital,  New  York  City,  who  objected 
to  such  identified  forms  being  sent  to  the  State  Commissioner  of  Mental  Hygiene  and 
computerized  in  a  state  file.     A  lawsuit  was  filed  on  behalf  of  three  doctors  at  the 
Center,  three  patients,  and  a  social  worker. 

The  suit  alleges  that  the  data-collection  is  "anti-therapeutic"  since  it  would, 
when  patients  learn  about  it,  deter  some  prospective  patients  from  seeking  treatment 
at  the  Center  or  lead  present  patients  not  to  disclose  sensitive  information  fully, 
thereby  interfering  with  the  professional  activities  of  doctors  ajid  social  workers. 
The  suit  states  that  the  disclosures  are  in  violation  of  the  doctor-patient  and  social 
worker-client  privileges  of  New  York  law;  provisions  of  the  state  Mental  Hygiene  Law 
("Names  of  patients  treated  at  outpatient  or  non-residential  facilities  and  at  general 
hospitals  shall  not  be  required.");  and  of  the  patient's  "constitutional  rights  to 
privacy,  due  process,  and  equal  protection  of  the  law." 

The  suit  also  challenged  the  degree  of  confidentiality  that  the  data  would  have: 

The  degree  to  which  the  information  is  kept  confidential  by  the 
Department  of  Mental  Hygiene  is  open  to  question.     There  is  some  indication 
that  any  doctor  or  employee  of  any  state  facility  can  obtain  the  information 
on  any  patient  in  the  state  simply  by  dialing  a  specific  telephone  number 
and  requesting  the  information.     By  law  the  information  is  available  to  any 
court  of  record,  the  Mental  Health  Information  Service  (the  legal  advocacy 
system  in  New  York),  anyone  receiving  the  consent  of  the  Commissioner  and 
of  the  patient,  and  with  the  sole  consent  of  the  Commissioner  to  any 
agencies  which  make  payments  on  behalf  of  the  patients,  such  as  Medicare 
or  Medicaid,  missing  persons  agencies,  criminal  agencies,  and  the  Firearms 
Control  Board  of  the  City  of  New  York. 

The  suit  asked  that  the  MS-5  form  be  held  illegal,  or  if  that  were  not  accepted, 
that  patient  data  be  kept  only  by  number  in  the  central  computer  and  the  links 
between  number  and  patient  name  be  kept  only  by  the  local  facility. 

However,  the  lower  court  upheld  the  Commissioner  at  the  initial  hearing, 
dismissing  the  suit  on  the  grounds  that  the  MS-5  represented  a  reasonable  exercise 
of  the  State's  powers.     An  appeal  is  now  pending. 

Comment 

The  three  episodes  above  are  similar  to  the  first  one  (Missouri)  in  their  basic 
outlines:  the  arrival  of  a  computer  stimulating  the  collection  of  such  data;  the  lack 
of  a  demonstrated  need  for  identified  data  for  evaluative  purposes;  and  the  lack  of 
accompanying  legislation  or  regulations  to  safeguard  identified  data.  The 
variations  occur  in  the  amount  of  detail  required.     Both  the  Washington  and  New  York 
reporting  forms  go  far  beyond  the  identification-payer-diagnosis  type  of  information 
requested  by  the  first  two  agencies;  they  require  submission  of  the  most  sensitive 
data  about  each  patient.    Even  if  a  need  could  be  demonstrated  for  the  collection 
of  some  identified  patient  data  for  evaluative  purposes,  therefore,  questions  would 
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still  be  raised  as  to  how  much  and  what  kinds  of  data  ought  to  be  collected  for 
such  purposes.     In  addition,  the  law  suit  brought  against  the  MS-5  form  in  New  York 
focuses  on  the  lack  of  confidentiality  of  the  material,  pointing  out  that  by  law 
the  information  would  be  available  to  courts,  to  service  payers,  to  missing  persons 
bureaus,  and  law  enforcement  agencies. 

It  is  also  worth  noting  that  in  three  of  the  four  episodes,  the  orgajiized 
protests  of  professional  groups  or  civil  liberties  organizations  resulted  in  the 
projects  either  being  abandoned  or  modified  to  take  at  least  some  of  the  citizens 
rights  demands  into  account.     The  episodes  also  illustrate  the  tendency  of  many 
government  agencies  to  plan  and  implement  new  automated  data  systems  without 
providing  notice  to  the  population  to  be  affected,  professional  groups,  citizens' 
organizations,  or  to  the  public  at  large.    Even  where  formal  notices  may  be  issued, 
there  is  often  a  practice  not  to  hold  meaningful  consultations  with  interested  groups 
or  Dublic  hearings  in  advance  of  instituting  such  systems. 

An  example  of  this  was  reported  in  January  of  1976  by  Alan  Taylor,  a  columnist 
for  Computerworld  who  writes  often  about  problems  of  making  computer  systems 
responsive  to  the  people  they  are  created  to  serve.     Taylor  related  that  the  State  of 
Maryland's  Health  Services  Cost  Review  Commission  published  a  brief  notice  in 
December  of  1975  in  the  obscure  Maryland  Register  announcing  that  it  would  require 
all  hospitals  to  furnish  each  patient's  Social  Security  number,  the  number  of  his/her 
"legally  responsible"  doctor  or  surgeon,  and  a  list  of  detailed  items  of  medical 
information.^    The  hospitals  affected  received  no  explanations,  nor  were  patients 
informed  of  what  would  be  done  with  the  data.     No  public  hearings  were  scheduled  to 
discuss  the  reporting  system,  which  was  to  go  into  effect  in  April  of  1976.     At  a 
meeting  in  January, 1976  of  the  Baltimore  and  V/ashington,  D.C.  Data  Processing  Medical 
Users  Group,   it  was  found  that  computer  specialists  in  Maryland  hospitals  were 
unaware  of  the  plan.     By  calling  the  Commission,  Taylor  was  able  to  learn  that  the 
Commission  intended  to  send  the  material  to  the  U.S.  National  Institutes  of  Health, 
but  little  else  was  communicated.  Taylor  deplored  this  style  of  creating  data  banks 
with  highly  sensitive  personal  information,  and  urged  that  the  Maryland  Commission 
"delay  its  data  base  implementation  until  information  is  released  and  reviewed  by  an 
impartial  authority  and  by  the  public." 

Incident!  The  California  Community  Services  Division^ 

In  an  effort  to  reduce  costs  ajid  control  eligibility  standards  for  welfare 
recipients,  the  state  of  California  computerized  its  welfare  rolls  and  required  local 
welfare  offices  to  submit  detailed  reports  on  each  client.     The  data  to  be  furnished 
included  reports  as  to  the   unemployability  of  individuals  due  to  mental  disability 
or  the  presence  of  mental  illness,  alcoholism,  drug  or  narcotic  dependency,  sex 
offender  status,  mental  retardation,  unwed  mother,  unwed  pregnancy,  "mentally 
incapable  of  personal  money  management,"  and  other  conditions — some  medical  and  some 
non-medical. 

In  1969,  two  psychiatric  social  workers  assigned  to  the  San  Francisco  office  of 
the  state  Community  Service  Division    refused  to  comply  with  the  requirement  to  submit 
these  reports. 
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They  maintained  that  furnishing  such  data  on  their  clients  to  the  state,  for 
use  in  a  computer  system  open  to  many  unknown  uses,  would  breach  the  confidentiality 
of  the  social  worker-client  relationship,  their  professional  code  of  ethics  to  keep 
such  information  confidential,  and  the  privacy  rights  of  their  clients.     The  State 
rejected  the  social  workers'  protest,  and  ordered  them  suspended  and  their  pay 
forfeited  for  five  days  for  "willful  disobedience"  of  Department  orders.  The 
Northern  California  ACLU  defended  the  two  social  workers  in  an  appeal  from  this 
action,  contending  that  the  state  welfare  department's  computer  system  was 
insufficiently  secure  in  its  confidentiality  and  security  protections,  thus 
justifying  the  social  workers'  refusal  to  submit  the  sensitive  psychiatric  and 
emotional  data  on  their  clients. 

This  position  was  rejected  by  the  California  courts  at  the  trial  and  appellate 

court  levels.     A  197^  Appelate  Court  opinion  held  that  the  social  workers  had  no 

psychiatrist's  privilege  under  California  law;  that  welfare  client  data  is  open  to 

administrators  of  the  welfare  system;  that  collection  of  case  data  is  essential  to 

administration  of  the  welfare  program;  that  welfare  clients  sire  not  entitled  to 

notice  nor  is  their  consent  required  for  inclusion  of  all  their  data  in  such  a  state 

computer  system;  that  it  was  the  Department's  responsibility  to  see  that  the 

confidentiality  provisions  of  the  state  welfare  code  were  met  in  their  management 

of  the  computerized  system;  and  therefore  that  no  right  of  privacy  of  the  clients  or 

privilege  of  the  caseworkers  had  been  violated.     The  five-day  suspensions  were 
7 

thereby  upheld.' 

Q 

Incident;  The  Washington  State  Department  of  Social  and  Health  Services 

In  January  of  1976,  200  caseworkers  in  the  Washington  State  Department  of  Socia 
and  Health  Services  filed  grievances  protesting  an  order  to  supply  the  Department's 
computerized  reporting  system  with  extensive  personal  information  on  welfare  clients 
The  state  said  these  client  reports  were  compulsory  under  Title  20  of  the  Social 
Security  Act,  as  amended  in  I975i  which  provides  funds  for  the  state's  welfare 
system.     The  state  welfare  workers  said  that  the  new  forms  called  for  information 
in  excess  of  what  the  federal  law  requires;  that  providing  the  information  (which 
included  physical  and  mental  health  data)  would  violate  the  confidentiality  of  the 
caseworker-client  relationship;  that  the  data  coding  required  by  the  form  produced 
"de -humanizing"  categorization  of  individual  situations;  and  that  there  were 
insufficient  controls  over  the  uses  that  would  be  made  of  the  personal  information 
and  who  would  have  access  to  it  once  it  left  the  welfare  agency's  own  files. 

The  state  welfare  department  rejected  the  positions  of  the  protesting  case 
workers,  and  one  woman  with  15  years  in  the  agency  was  fired  for  refusing  to  submit 
her  client's  data.     The  case  workers  who  filed  the  grievances  have  been  supported 
by  their  union,  the  American  Federation  of  State,  County,  and  Municipal  Employees, 
and  a  lawsuit  to  block  the  reporting  requirements  has  been  threatened,  with  local 
civil  liberties  support,   if  the  state  does  not  modify  its  requirement. 

Comment . 

The  common  element  here  with  the  episodes  described  earlier  is  the  concern 
over  leakage  of  sensitive  data  to  other  government  agencies,  or  over  insecurely 
protected  data  systems.     But  the  main  purpose  of  California's  computerization  of 
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welfare  records  is  different  from  the  computerization  in  the  previous  examples  and 
raises  another  difficult  question.     In  the  previous  examples,  a  compelling  case  could 
be  made  that  identified  data  was  not  necessary  to  do  program  evaluation  and 
utilization  studies.     But  where  the  goal  is  welfare  eligibility,   identified  data  is 
obviously  essential.     If  one  accepts  the  proposition  that  the  government  has  the 
right     to  impose  and  enforce  welfare  eligibility  standards — a  proposition  that  neither 
society  nor  the  law  seriously  questions — then  the  issue  becomes  not  whether  or  not 
to  collect  identified  data,  but  how  much  and  under  what  circum.stances .     Thus,  the 
courts  have  ruled  that  in  determining  welfare  eligibility  the  state  may  legitimately 
inquire  as  to  how  many  members  are  in  an  applicant  family  and  what  their  incomes  are. 
However,  the  state  may  not  conduct  surprise  nighttime  visits  to  an  applicant  family 
to  discover  whether  there  is  an  "unauthorized"  man  living  in  the  house  (who  might 
be  supplying  unreported  income),  since  such  visits  violate  constitutional  rights  to 
privacy. 

Thus,  the  questions  raised  by  the  California  incident  are:   (a)  What  limits 
should  be  set  to  assure  that  the  information  requested  is  relevant  to  the  stated 
purpose  in  this  case,  v/elfare  eligibility?;     (b)  Should  these  limits  bar  the 
collection  of  sensitive  psychiatric  and  emotional  data,   especially  in  view  of  the 
fact  that  such  data  might  be  made  available  to  other  state  agencies,  especially  law 
enforcement  officials?;     (c)  Do  clients  have  the  right  to  know  that  information 
confided  to  a  social  worker  will  be  forwarded  to  a  central  computer,  and  possibly 
be  made  available  to  other  state  agencies? 

Problem;     Juvenile  Records 

Juvenile  records  kept  by  both  police  departments  and  juvenile  courts  raise 
special  problems  because  of  the  anomalous  position  of  juveniles  in  our  criminal 
justice  system.     Both  the  police  and  the  courts  assume  responsibility  for  juveniles 
in  cases  where  no  criminal  behavior  is  suspected  or  charged — runaways,  truants, 
neglected  children,  psychologically  troubled  children,  etc.     Many  states  and  large 
metropolitan  areas  keep  extensive  computerized  records  on  such  children,  which 
includes  educational,  medical,  and  family  background  Information.  Moreover,  many 
juveniles  run  afoul  of  the  law,  and  are  even  taken  into  custody  for  behavior  which 
in  an  adult  would  not  be  considered  an  offense.     In  New  York  City,  for  example, 
the  Police  Department  maintains  a  computerized  file  for  almost  every  minor  who 
encounters  the  police    (about  60,000  a  year),   and  files  a  YD  (Youth  Division)  card  for 
each.     A  study  conducted  by  the  city's  Criminal  Justice  Coordinating  Council 
concluded  that  nearly  half  of  the  YD  cards  were  filed  for  such  acts  as  "loudness, 
boisterousness • . . use  of  obscene  language,  annoying  people,  throwing  objects... 
swimming,  etc..."     In  approximately  ^-0%  of  these  cases,   the  study  found,  there  is  no 
check  on  the  validity  of  the  initial  decision  to  classify  the  behavior  as  an  offense. 
YD  cards  are  filed  for  the  victims  of  offenses,  although  there  is  no  evidence  of 
improper  behavior  on  the  part  of  the  victims.     When  a  youth  is  innocently  involved, 
or  when  the  initial  issuance  of  a  YD  card  is  unauthorized,  the  offense  report  remains 
in  the  data  banks. 

Despite  such  shortcomings,  the  study  found  the  YD  record  to  be  a  major 
determinant  in  the  disposition  of  subsequent  charges.     Minors  with  three  or  four 
entries  on  their  YD  cards  were  much  less  likely  to  qualify  for  probation  or  to 
have  their  cases  dismissed  than  those  with  no  record,  no  matter  what  the  seriousness 
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or  relevance  of  the  particular  entry.     Length,  not  content,  appeared  to  matter  most. 

A  number  of  states  have  computerized  juvenile  court  files,  and  the  materials 
submitted  to  them  are  taken  from  the  forms  used  by  counselors  who  interview  juveniles 
in  connection  with  juvenile  court  proceedings.     The  ACLU  has  raised  two  questions 

Q 

about  these  forms. ^  First,  the  boxes  to  be  checked  Include  such  terms  as  "schizoid," 
"Latently  psychotic,"  and  similar  brief  descriptions.     "Instead  of  a  complex 
diagnosis  which  any  one  of  these  conditions  would  merit,"  the  ACLU  project  on 
Privacy  and  Data  Collection  recently  noted,   "the  diagnosis  is  reduced  to  one  word  so 
that  it  can  be  easily  computerized."     The  second  concern  is  that  the  terms  call  for 
professional  diagnoses,  but  the  counselors  are  not  medical  doctors  or  psychiatrists. 
The  ACLU  goes  on  to  state  that  though  the  juvenile  or  his/her  representative  may  not 
see  these  labels,  they  are  accessible  not  only  to  juvenile  court  personnel,  but  also 
"researchers,  the  FBI,  the  military  and  prospective  employers..." 

Comment 

Previous  episodes  have  raised  the  question  of  the  need  for  identified  patient 
information  to  be  collected  at  all,  and  where  the  need  for  identified  information  is 
demonstrated,  the  amount  of  data  that  should  appropriately  be  collected.  That 
question  is  raised  in  a  most  striking  way  by  the  New  York  YD  system  (and  many  other 
metropolitan  police  juvenile  division  practices)  because  the  collection  of  this 
non-criminal  information,  much  of  it  containing  sensitive  psychological  data,  can 
lead  to  criminal  penalties. 

The  question  raised  by  computerized  court  records  is  the  form  in  which  the  data 
may  be  collected;  that  is,  does  the  short  hand  term  fostered  by  computer  coding 
distort  the  diagnosis,  even  if  it  is  an  accurate  one?    Should  such  diagnoses  be  used 
when  made  by  a  non-professional? 

These  questions  are  of  particular  importance  because  of  society's  policy 
towards  juveniles.     For  these  children  whose   "offenses"  do  not  lead  to  court  action, 
but  are  kept  on  police  indexes  such  as  the  New  York  YD  index,  there  is  no  protection 
against  their  records  being  exchanged  with  other  police  departments  or  private 
employers.     In  describing  the  Orange  County,  California  Central  Juvenile  Index 
lawyers  who  defend  juveniles  say  "The  Central  Juvenile  Index  is  like  a  sieve.  Every 
department  store  and  every  insurance  company  hires  moonlighting  cops  and  excops... 
because  they  or  their  buddies  have  access  to  the  records..." 

On  the  other  hand,  disclosure  and  recording  of  sensitive  juvenile  court  records 

is  encouraged  because  of  the  widespread  belief  that  juvenile  records  are  either 

expunged  or  permanently  sealed  after  a  period  of  years,  and  therefore  that  the 

information  in  them  will  not  be  available  to  other  government  agencies  or  private 

organizations.     Indeed,  both  the  federal  Youthful  Offender  Act  and  most  state 

juvenile  laws  provide  for  this.     But  in  fact,  when  juvenile  arrests  and/or 

convictions  are  reported  to  the  FBI,  they  are  not  specially  sequestered,  but  are 

placed  in  the  regular  criminal  files  and  made  available  to  any  "authorized"  agency 

11 

which  requests  them.        Authorized  agencies  include  not  only  state  and  local  law 
enforcement  agencies,  but  licensing  bureaus,   the  Civil  Service  Commission  and  other 
government  employers,  private  banks  and  other  non-law-enforcement  organizations. 
Thus,  in  spite  of  protective  juvenile  expungement  and  sealing  laws,   juvenile  records 
are  almost  as  widely  disseminated  as  those  of  adults  who  have  been  arrested  or 
convicted . 
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Incident;  The  Maryland  Data  System  for  the  Handicapped 

In  1971,   six  Maryland  state  agencies — Education,  Juvenile  Services,  Welfare, 
Retardation,  Mental  Health  and  Preventive  Medicine — combined  forces  to  contribute 
identified  data  on  all  handicapped  children  to  a  central  computer  file.  Handicap 
was  defined  to  include  not  only  physical  problems  such  as  hearing  and  vision 
disorders,  but  "personality  disorder,"  "major  affective  disorder,"  "sexual  deviation," 
and  "adjustment  reaction."  About  10%  of  the  school  age  population  was  expected  to  be 
covered.     One  of  the  ways  in  which  the  data  was  to  be  collected  was  by  distributing 
forms  to  public  school  teachers  who  would  be  asked  to  fill  them  in  for  each  child  in 
whom  they  observed  one  of  the  listed  problems.     The  matter  first  came  to  the  attention 
of  civil  liberties  groups  when  several  Prince  Georges  County  teachers  refused  to  fill 
in  the  form  because  they  felt  they  were  not  qualified  to  make  medical  or  psychiatric 
judgments . 

The  Data  System  for  the  Handicapped  (DSH)  was  intended,  state  officials  said, 
to  collect  data  from  the  participating  state  agencies  for  research  purposes  only. 
One  state  official  stated  that  it  would  help  the  state  determine  what  resources 
needed  to  be  allocated  to  special  facilities  for  the  education  of  handicapped 
children. 

Originally,  the  ACLU  of  Maryland  was  a  member  of  a  Parent  Interest  Group 
Advisory  Committee  for  the  DSH  system.     However,   it  withdrew  from  that  committee  in 
197^+  because  it  concluded  that  the  system  as  it  was  set  up  was  not  dealing  adequately 
with  the  privacy  and  confidentiality  problems  involved.     It  charged  that  the  system 
did  not  provide  parental  notification  or  review  of  the  record  created  on  a  child;  did 
not  consider  the  right  of  minors  to  control  these  decisions  themselves  (rather  than 
parents)  where  the  minors  are  of  sufficient  age;  did  not  assure  periodic  updating  of 
records;  did  not  secure  parental  consent  to  inter-agency  exchange  of  records;  and 
had  not  developed  methods  to  compile  the  statistical  data  desired  without  placing 
names  or  other  unique  identifiers  in  the  central  file.     Noting  that  it  had  received 
dozens  of  complaints  from  parents  and  professional  groups  about  the  system,  and  that 
"improper  labelling"  seemed  to  be  an  integral  part  of  the  operation,  the  ACLU  called 
upon  the  state  to  halt  operation  of  the  DSH  system  until  proper  standards  and 
procedures  had  been  developed. 

The  state  responded  to  the  ACLU  (and  to  the  protests  of  several  counties)  by 
announcing  that  it  was  going  to  file  records  only  by  a  code  number,  not  by  name; 
that  data  would  not  be  furnished  to  outside  agencies,  and  that  consent  and  access  was 
not  relevant  since  only  statistical  uses  were  intended.     They  also  promised  to 
re-examine  their  labels,  and  to  consider  creating  more  precise  categories.  These 
were  valuable  changes,  but  the  ACLU  of  Maryland  still  considers  the  DSH  system  to  be 
insufficient  in  its  safeguards. 

Comment 

The  problems  here  are  three  that  we  have  previously  identified:   (1)  the  concern 
over  later  inter-agency  interchange;   (2)  the  short-hand  terms  to  facilitate 
computerization  which  may  distort  the  meaning  of  the  diagnosis;  and  (3)  the 
collection  of  medical  data  by  individuals  who  are  not  qualified  to  make  medical 
judgments.     There  is,  however,  an  accompanying  societal  problem  to  which  we  have 
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already  alluded  at  several  places  in  the  report,  that  computerization  of  identified 
medical  records  is  declared  necessary  to  provide  a  desirable  benefit  to  the 
individuals  about  whom  the  information  is  being  gathered — in  this  case,   to  provide 
resources  for  the  education  of  handicapped  children  -  but  such  a  benefit  is  not 
forthcoming,  at  least  not  yet  in  Maryland. 

1 3 

Incident;  The  Maryland  State  Abortion  Surveillance  Unit 

In  Maryland,  the  State  Abortion  Surveillance  Unit,  part  of  the  state  Center  for 
Health  Statistics,  began  in  I968  collecting  data  on  women  having  abortions  in  the 
state,  for  "descriptive,  planning,  and  evaluation  purposes."     I968  was  the  year  that 
Maryland  law  was  liberalized  to  permit  abortions  for  mental  as  well  as  physical 
health  reasons,  and  the  state  decided  that  keeping  statistical  data  on  the  number 
of  abortions,   the  ages  and  demographic  characteristics  of  the  women,  etc.  was  a 
major  new  concern  for  health  analysts.     This  belief  was  strengthened  when  abortions 
in  Maryland  went  up  substajitially ,  following  the  1972  Supreme  Court  decision  striking 
down  restrictive  state  anti-abortion  laws. 

However,  the  activities  of  the  Abortion  Surveillance  Unit  drew  heavy  fire  in 
197k  from  the  National  Organization  of  Women,   the  Children's  Defense  Fund,  and  the 
Maryland  ACLU.     Representatives  from  these  groups  noted  that  while  the  name  is  not 
included  on  the  form  issued  by  the  Unit,  it  did  require  the  patient's  block  number 
address  and  hospital  case  number  (which  was  often  the  patient's  social  security 
number),  and  patients  were  not  informed  of  or  asked  to  agree  to  the  sending  of  their 
data  to  the  state  Unit  by  doctors  and  health  institutions.     "These  files  are  there  so 
that  at  any  time  someone  could  make  an  administrative  decision  to  share  the 
information  with  another  agency,"  said  J.B.  Dillingham,   of  the  Children's  Defense 
Fund.     In  addition,  critics  noted  that  many  women  felt  quite  uneasy  about  the  idea 
that  a  state  file  kept  a  permanent  record  of  their  abortions.     The  form  also 
included  the  notation  whether  the  reason  for  the  abortion  was  "elective,  physical 
health,  mental  health,  rape,  congenital  defect,  or  other,"  which  was  also  considered 
an  intrusive  element  about  the  patient  to  be  kept  in  the  state  system. 

Dr.  Frances  Warthen,  director  of  Maryland's  Center  for  Health  Statistics, 
defended  the  program  as  one  that  was  necessary  because  hospitals  prior  to  the 
surveillance-report  requirement  often  submitted  "incomplete"  yearly  tabulations. 
She  also  explained  that  the  block  number  and  hospital  case  number  were  not  entered 
into  the  computerized  filej  the  block  number  was  used  only  to  place  the  case  within 
a  given  census  tract  for  statistical  reporting,  and  the  hospital  number  was  obtained 
"should  the  facility  need  to  be  contacted  for  more  information  about  a  particular 
patient . " 

These  explanations — especially  the  vagueness  as  to  future  uses  of  the  hospital 
number — did  not  satisfy  the  critics.     After  consulting  with  them,  Dr.  Warthen  agreed 
that  the  block  address  and  patient  identification  number  would  be  crossed  off  the 
form  once  the  information  was  fed  into  the  computer.     In  that  way,  she  said,  "there 
are  no  identifiers  on  any  tape  that  also  contains  medical  information."  Protest 
over  this  activity  still  continues,  however. 
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Incident;  The  New  York  City  Fetal  Death  Registry 

In  New  York  City,  a  test  case  by  a  physician  and  his  patient,  supported  by  the 
New  York  Civil  Liberties  Union,  led  to  a  lower  court  ruling  in  1972  striking  down  a 
city  requirement  that  the  name  and  address  of  the  patient  be  provided  to  the  city 
fetal  death  registry  by  the  physician  in  all  cases  of  medical  abortions.  The 
patient  complained  that  furnishing  her  name  and  address  invaded  her  privacy  by 
intruding  into  one  of  the  most  intensely  personal  aspects  of  a  woman's  life;  it  also 
forced  the  physician  to  breach  a  confidential  communication.     The  court  observed 
that  there  was  no  statutory  direction  that  the  name  emd  address  be  put  into  the 
registry,  and  no  proof  made  out  that  the  city  needed  this  for  statistical  and  public 
health  purposes,  yet  the  requirement  had  the  effect  of  jeopardizing  the  state's 
liberalized  abortion  policies.     The  court  held  that  compelling  disclosure  of  name 
and  address  was  "arbitrary  and  capricious,"  an  "unlawful  invasion"  of  the  patient's 
rie^ht  to  privacy,  and  an  improper  interference  with  the  "clearly  cherished  right  of 
absolute  confidentiality  of  a  physician-patient  relationship." 

In  December  of  1975.  the  New  York  Court  of  Appeals  reversed  that  ruling  in  a 
k-3  decision  that  upheld  the  city's  power  to  require  physicians    to  report  the  names 
and  addresses  of  all  women  receiving  abortions  to  the  central  fetal  death  registry . 
The  majority  found  proper  and  "laudable"  the  city's  purposes  to  monitor  procedures, 
facilitate  follow-up  of  complications,  track  possible  adverse  effects  of  abortions, 
and  offer  family  counseling,     The  fact  that  the  U.S.  Supreme  Court  had  upheld  the 
constitutional  power  of  states  to  adopt  regulations  for  abortions  during  the  second 
trimester  of  pregnancy  was  considered  support  for  the  city's  action.     In  the  absence 
of  any  allegations  that  the  information  was  being  used  improperly  or  being 
disseminated  for  other  purposes,  the  majority  said  that  there  was  no  infringement 
on  the  right  to  abortion  or  of  the  patient's  right  to  privacy. 

The  dissenters  felt  that  "the  right  to  privacy  which  the  Supreme  Court  extended 
to  a  woman's  decision  to  abort  necessarily  extends  to  and  includes  her  right  to 
guard  her  identity  from  a  centralized  abortion  registry."    They  noted  that  all  the 
purposes  sought  by  the  city  could  be  accomplished  by  using  either  files  in  the 
hospitals  or  statistical  reporting  to  the  registry.     The  case  is  now  being  appealed 
to  the  U.S.  Supreme  Court. 

1 6 

Problem;  Child  Abuse  Registries 

One  area  in  which  the  central  registry  idea  has  taken  hold  with  particular 
firmness  in  the  past  decade  is  child  abuse.     In  I966,  only  four  states  had  central 
registers  to  which  instances  of  child  abuse  were  reported;  by  197^»  30  states  had 
passed  laws  requiring  such  registers  (in  varying  forms)  and  many  local  governments 
had  enacted  them  as  well.     The  laws  generally  require  doctors,  hospitals,  school 
officials,  welfare  officials,  and  other  professional  groups  to  report  wounds  and 
injuries  sustained  by  children.     Some  of  the  registries  allow  any  individual  who 
wishes  to  volunteer  a  report  of  child  abuse.     During  the  past  few  years,  while 
approving  the  general  purpose  of  protecting  abused  children,  civil  liberties  and 
other  citizens  groups  have  opposed  drafts  of  such  child  abuse  registery  laws  in 
some  states  when  these  lacked  sufficient  provision  for  due  process  hearings  before 
adults  were  listed  as  child  abusers;  when  the  system  could  lead  to  "potential 
blackmails"  when  case  reports  that  might  be  based  on  shaky  evidence  would  be 
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available  to  various  public  officials  such  as  the  police,  welfare  administrators 
etc;  and  when  "a  permanent  computer  file  of  an  alleged  child  abuser  could  follow 
him  around  all  the  rest  of  his  life."     In  several  cases,  protests  by  civil  liberties 
groups  resulted  in  the  enlargement  of  safeguards  in  the  enabling  legislation,  and 
were  then  enacted. 

Problem;  Drug  Prescription  Registries 

During  the  early  1970 's,  many  states  enacted  laws  requiring  dispensing  physicians 
or  pharmacists  to  send  the  state  a  form  whenever  they  dispensed  certain  drugs  having 
"high  potential  for  abuse."    The  specified  drugs  included  not  only  morphine  and 
codeine  but  also  ritalin,  percodaji,  and  hucodan;  these  drugs  are  widely  used  in 
treatment  of  obesity,  high  blood  pressure,  hyperkinetic  children,  epilepsy,  migraine 
headaches,  and  other  "regular"  medical  problems.     The  compulsory  report  includes  the 
name  and  address  of  the  patient. 

New  York  enacted  such  a  law  in  1973,  and  set  up  a  computerized  "controlled 
drugs"  registry  in  Albany  maintained  by  the  State  Bureau  of  Controlled  Substances, 
Licensing,  and  Evaluation.     The  registry's  purpose,  according  to  the  State,  was  to 
identify  persons  who  obtained  multiple  prescriptions  or  received  more  than  a  30  day 
supply  of  these  drugs.     After  20  months  of  operation,  the  registry  had  about  two 
million  prescriptions  recorded. 

Several  groups  in  New  York — the  Empire  State  Physicians  Guild,  the  Legal  Action 

Center,  and  the  New  York  Civil  Liberties  Union — brought  suit  in  federal  court  to  have 

the  registry  law  declared  unconstitutional.     A  federal  court  of  appeals  held  it 

unconstitutional  in  1975  as  an  unjustified  invasion  of  the  privacy  of  the  doctor- 
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patient  relationship.        At  the  court  hearing,  several  patients  testified  that  they 

stopped  taking  the  designated  medicines  when  they  learned  that  they  were  being 

recorded  in  the  state  registry: 

"A  cancer  patient  using  percodan  for  pain  stopped  taking  the 
drug  when  he  learned  of  the  registration.     He  tried  other  drugs  which 
did  not  relieve  his  suffering,  and  now  orders  the  drug  through  his 
union  from  sources  outside  the  state." 

"Another  patient  said  she  had  used  a  medication  containing  codeine 
for  migraine  headaches,  but  when  she  learned  that  her  name  would  be 
reported  to  Albany  and  put  on  a  computer,  she  stopped  the  medication." 

"A  woman  whose  child  suffered  from  hyperkinesia  took  the  child  off 
ritalin  rather  than  have  him  'branded  for  life'    as  a  drug  user," 

The  court  said  the  issue  was  a  "troublesome"  one,   since  the  state  was  trying  to 
deal  with  the  very  real  problems  of  drug  abuse.     However,  the  court  noted  that  only 
one  person  going  from  doctor  to  doctor  for  prescriptions  had  been  found  in  20  months; 
to  compile  a  data  base  of  over  2  million  personally  identified  prescriptions  for  such 
results,  the  court  said,  was  "too  high"  a  price  "in  dimunition  of  freedom." 

"An  individual's  physical  ills  and  disabilities,  the  medication  he  takes,  the 
frequency  of  his  medical  consultation  are  among  the  most  sensitive  of  personal  and 
psychological  sensibilities ....  One  does  not  normally  expect  to  have  to  reveal  to  a 
governmental  source  these  facets  of  one's  life.     One  is  wont  to  feel  that  this  is 
nobody's  business  but  his  doctor's  and  his  pharmacist's." 

To  the  state's  argument   that  compiling  a  registry  in  Albany  was  no  different  from 
having  the  name  and  address  on  file  with  pharmacists  the  court  replied: 
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"A  name  on  a  prescription  in  the  files  of  one  of  the  many  thousands  of  pharmacists 

in  the  state  is  entirely  different  from  one's  name  on  a  form  in  Albany  which  is 

transferred  to  computerized  records  and  stored  for  instant  retrieval." 

A  similar  protest  was  mounted  in  Rhode  Island  in  October  of  1975.  at  a  hearing 

held  by  the  State  Health  Department  to  allow  public  comment  on  a  proposal  to  set  up 
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a  similar  state  registry  of  "high  abuse  potential"  drugs.        The  Rhode  Island  ACLU 
testified  that  this  would  create  a  derogatory  data  bank  even  though  the  individuals 
listed  in  it  had  all  been  prescribed  legal  drugs  by  licensed  physicians.     ACLU  State 
Director  Michael  Dollinger  said  that  he  knew  of  no  legal  authority  that  would  allow 
the  state  to  "so  invade  the  privacy  of  the  doctor-patient  relationship."    He  stressed 
that  if  the  state  wanted  to  detect  over-prescribing  or  over-dispensing  of  drugs, 
and  detecting  theft  or  forgeries,  this  could  be  done  by  removing  the  patient's  name 
and  address  from  the  reports,  and  monitoring  patterns  of  doctor  or  phajrmacist 
conduct.     Even  if  the  goal  was  to  detect  persons  who  go  from  doctor  to  doctor  to  get 
prescriptions,  Dollinger  pointed  out  that  such  persons  could  easily  change  their 
names  each  time,  and  thereby  escape  detection  by  the  registry.     As  in  the  New  York 
case,  the  Rhode  Island  ACLU  presented  testimony  that  some  individuals  had  refused 
prescribed  medication,  against  the  advice  of  their  physicians,  because  of  fears  of 
"being  included  in  the  state's  data  file  of  'drug  addicts'." 

1  Q 

Problem;  Narcotics  Addict  Registries  ^ 

Confidentiality  of  data  in  drug-abuse  treatment  programs  has  been  a  major  area 
of  controversy  during  the  past  few  years,  with  automated  files  playing  a  growing  role 
in  the  issue.     Essentially,  drug-abuse  treatment  centers  represent  a  decision  by  their 
sponsors  (and  government  funding  sources)  to  follow  a  medical  rather  than  criminal 
approach  to  addiction;  preserving  strict  confidentiality  for  patient  identity  and 
case  details  is  critical  to  the  success  of  these  ventures.     This  was  recognized  by 
the  1970  and  1972  federal  laws  on  drug-abuse  prevention  and  control.    After  providing 
federal  funds  for  treatment,  rehabilitation,  and  research  programs,  these  laws 
afford  protection  for  the  identities  and  records  of  persons  receiving  treatment  in 
federal-agency  programs,  or  federally  licensed  ones,  or  drug  research  programs  by 
state  or  private  agencies,  when  these  have  been  specifically  designated  by  the 
Secretary  of  HEW  or  the  Attorney  General  to  be  exempted  from  compulsion  of 
participant  identities  in  any  federal,   state,   or  local  proceedings. 

Most  drug-abuse  treatment  centers  are  not  so  protected,  however,  and  studies 

disclose  constant  pressures  from  police,  licensing  agencies,  employers,  and  others 
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to  learn  the  identities  of  program  participants.        Some  of  this  pressure  comes 

from  requirements  that  physicians  must  report  to  the  state  the  identity  and  status 

of  every  addicted  person  they  are  treating  (1/3  of  the  states  have  such  requirements). 

"■'any  states  also  have  narcotics-addict  registries,  based  on  reports  of  identified 

patients  from  physicians  and  treatment  centers  throughout  the  state.     Some  of  these 

states,   like  New  Jersey,  have  computerized  their  registers.     V/here  federal  or  state 

agencies  provide  funding  for  treatment  centers,  they  often  insist  on  having 

identified  patient  reports  sent  to  them  for  auditing  and  evaluation  purposes,  and 

these  are  frequently  put  into  state  central  databanks.     As  a  leading  article  on  this 

21 

issue  by  McNamara  and  Starr  m  the  Columbia  Law  Review  noted  in  1973 f 
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These  centralized  state  and  federal  data  banks  of  narcotics- 
treatment  information  are  a  great  threat  to  confidentiality.     Of  the 
(172)  treatment  centers  responding  to  our  survey,  problems  in 
protecting  client  records  were  cited  50  per  cent  more  frequently  by 
centers  located  in  states  with  centralized  addiction  registries  than 
by  those  located  in  other  states.     The  information  sought  from  the 
centers  included  drug,  criminal  and  medical  history,  social  and 
demographic  data,  prior  drug  treatment  information,  and  employment 
data. 

The  McNamara  and  Starr  study  noted  that  protecting  the  physical  security  of 
treatment  center  files  was  a  problem  for  the  managers;  given  available  "sophisticated' 
procedures,  the  authors  felt  computerized  records  could  be  kept  more  securely  than 
the  usual  manual  records.     But  they  also  saw  the  compactness  and  ease  of  search  of 
the  file  making  computerized  files  particularly  tempting  to  overzealous  law 
enforcement  agents  and  other  Intruders. 

The  study  also  noted  that  undercover  police  agents  have  been  sent  into  some 
treatment  centers  posing  as  clients  or  applying  for  jobs,  as  a  means  of  getting 
confidential  information  on  participants.     These  situations  suggest  that  protecting 
files,  whether  manual  or  computerized,  would  take  special  alertness  to  efforts  at 
penetration  from  inside  as  well  as  outside. 

Conflicts  over  the  confidentiality  of  drug-abuse  treatment  records  are  still  a 
major  confidentiality  issue  today.     In  Cleveland,  Ohio,   the  local  ACLU  in  197^ 
criticized  ODerations  of  the  county's  central  computerized  registry  for  patients 
receiving  methadone  treatment.     The  registry's  purpose  was  to  prevent  individuals 
from  enrolling  in  more  than  one  program.     But  the  data  collected  (following  federal 
regulations  for  methadone  programs)   included  many  sensitive  items — age,  sex, 
educational  level,  employment  history,   criminal  history,  past  history  of  drug  abuse 
of  all  types,  and  prior  treatment  for  drug  abuse.     The  Cleveland  aCLIi  objectea  to 
what  it  felt  were  overbroad  disclosure  provisions  for  such  data,  and  the  conditioning 
of  a  government  benefit  on  the  individual's  willingness  to  surrender  his/her 
privacy.     They  also  insisted  that  patients  should  have  a  right  "to  access  and  correct 
the  file,"  which  was  not  provided. 

Similar  protests,   including  lawsuits  challenging  such  drug-abuse  registries  or 

funding-agency  reporting  duties,  have  arisen  recently  in  San  Francisco,  Maryland, 

22 

and  New  York,  among  others.        Two  states  m  1973 — Massachusetts  and  Pennsylvania-- 

refused  to  accept  federal  drug  treatment  funds  as  long  as  patient  information 

required  by  a  "Client  Oriented  Data  Acquisition  Process"  (CODAP)  had  to  be  submitted 

to  a  computerized  file  maintained  by  the  White  House  Special  Action  Office  for  Drug 
23 

Abuse  Prevention. 

The  Massachusetts  action  is  worth  examining  more  closely.     After  the  Governor 
informed  the  White  House  Office  for  Drug  Abuse  Programs  that  it  would  do  without 
federal  funds  rather  than  submit  patient  identifying  data,  the  federal  officials 
exempted  the  state  from  that  requirement.     "If  Massachusetts  will  take  the 
responsibility  for  providing  aggregate  data,"  the  director  of  the  office  said,  "that 
will  be  all  right  with  us."    Massachusetts  therefore  kept  personal  identification 
data  at  individual  drug  treatment  clinics  or  the  state's  Mental  Health  Department. 
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Massachusetts  then  found  itself  faced  by  another  federal  drug  reporting  demand. 
Project  DAWN  (Drug  Abuse  Warning  Network),  a  project  of  the  Drug  Enforcement 
Administration  of  the  U.S.  Justice  Department,   calls  on  hospitals  and  crisis-centers 
to  report  drug  overdose  incidents.     In  1973 »  at  the  request  of  the  White  House 
Office  on  Drug  Abuse,  the  DAWN  project  added  to  its  reporting  forms  the  following 
information:  subject's  birthdate,  race,  sex,  the  first  two  letters  of  the  subject's 
mother's  given  name  and  her  surname.     Again,  the  Governor  of  Massachusetts  refused 
to  submit  identifying  data,  saying  that  institutions  in  his  state  would  not 
cooperate  in  the  DAWN  project  if  these  were  required.     The  Governor's  spokesman 
called  the  identification  requirements  "a  bad,   ill-advised  program." 

Massachusett 's  protest  led  Senator  Sam  Ervin  Jr.  and  the  Senate  Subcommittee 
on  Constitutional  Rights  to  call  the  federal  drug  program  officials  before  it  in 
1973,  raise  the  citizens  rights  issues,  and  call  on  the  administration  to  reconsider. 
Senator  Ervin  reported  to  Congress  that  "once  the  agencies  reconsidered,  they 
decided  that  they  could  get  along  without  the  objectionable  information  after  all. 
Their  data-gathering  continues,  but  a  small  blow  has  been  struck  for  better,  less 
obtrusive  government." 

Comment 

Computerized  central  registries  organized  around  a  single  theme — child  abuse, 
abortion,  drug  abuse,  etc. — present  in  another  form  all  of  the  problems  we  have 
previously  catalogued.     This  is  because  a  central  registry  is  by  its  nature  a 
governmental  catch-all.     Some  agencies  with  access  to  the  registry — or  ready  to 
seek  access — will  see  it  as  invaluable  for  research;   others  for  providing 
rehabilitation  and  social  services;   others  for  eligibility  decisions  or  to  avoid 
duplication  of  benefits;  and  still  others  for  law  enforcement  purposes.  The 
registries,  typically,  are  created  because  there  is  general  agreement  that  society 
has  a  difficult  problem  that  it  must  solve  and  that  the  first  step  toward  a 
solution  must  be  identification  of  those  either  suffering  from,   or  participating  in, 
the  problem  behavior.     These  generally  accepted  perceptions  lead  to  the  creation 
of  a  central  registry,  and  since  computerization  facilitates  collection  of  such  data, 
the  move  to  central  registries  has  been  heavily  accelerated  by  computerization  in 
the  past  few  years. 

Although  there  is  often  public  agreement  that  a  central  registry  is  a  good 
idea,  there  is  less  agreement  as  to  which  of  the  above-listed  purposes  it  should 
serve,  generally  because    social  viewpoints  differ  as  to  the  larger  question  of  how 
the  problem  should  be  solved.     As  a  result,  such  registries  tend  to  collect  all  the 
data  they  can  on  a  particular  subject  in  order  to  serve  each  of  the  various 
government  agencies,   should  the  occasion  arise. 

The  ill-defined  goals  tend  to  be  reflected  in  ill-defined  limits  as  to  the 
identification  of  individuals,  what  data  is  to  be  collected,  who  contributes  to  the 
collection,  and  rules  for  dissemination.     A  distinctive  'feature  of  some  registries 
is  that  unidentified  persons  may  contribute  unsubstantiated  incidents  of  what  they 
regard  as  questionable  behavior.     This  is  true  of  most  child  abuse  registries  and 
of  some  drug  abuse  registries. 
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Incident!  The  Texas  Central  Data  Bank 

In  197^^  Texas  announced  that  it  was  establishing  a  computer  file  at  the  state 
level  that  would  pull  together  and  record  all  the  state  "client"  services  an 
individual  is  receiving.     Each  record  would  have  name,  Social  Security  number,  race, 
and  date  of  birth  among  its  personal  data,  and  then  contain  a  summary  of  state 
services  being  provided — health,  mental  health,  rehabilitation,  blindness, 
alcoholism,  probation,  welfare,  employment,  college  and  university,  retardation, 
youth  services,  and  others.     Governor  Dolph  Briscoe  explained  that  the  state 
services  index  was  needed  to  eliminate  duplicate  applications,  coordinate  provision 
of  services,  and  improve  overall  state  planning  and  organization  of  social  programs. 
The  ACLU  of  Texas  and  other  citizens  groups  criticized  the  program  on  the  ground 
that  existing  federal  and  state  laws  or  regulations  expressly  provide  for  the 
confidentiality  of  some  of  these  services,  and  that  opening  the  index  to  state 
officials — even  just  the  listing  that  someone  was  receiving  a  "service" — could  be 
highly  intrusive.     John  Duncan,  executive  director  of  the  Texas  ACLU,  warned  that 
"the  plan  creates  the  potential  that  with  the  press  of  a  button,  a  nosy  dean  can 
find  out  if  a  student  has  received  psychiatric  services  from  the  Department  of  Mental 
Health,   or  a  prying  bureaucrat  in  the  Employment  Commission  can  find  out  if  a  person 
was  a  juvenile  offender  years  ago." 

The  Texas  ACLU  also  criticized  the  "consent"  feature  of  the  state  plan.  When 
state  officials  noted  that  a  service-recipient's  consent  would  be  required  before 
his/her  name  would  be  entered  in  the  index,  the  ACLU  replied  that  agreement  would 
rarely  be  uncoerced  under  these  circumstances.     "What  individual  who  has  received 
services  from  a  mental  health  clinic,  been  confined  in  Texas  Youth  Council 
facilities,  been  treated  for  alcoholism,  or  received  food  stamps  would  freely 
consent  to  having  this  information  float  from  agency  to  agency  via  computer?" 
In  early  1975,  Texas  abandoned  this  plan  because  of  lack  of  funds. 

2  5 

Incident:  Wisconsin  Central  Data  Bank 

Similar  multi-file  databanks  at  the  county  and  city  level  have  also  drawn  fire 
on  citizen  rights  grounds.     In  Wisconsin  the  state  Departments  of  Health  and  Mental 
Hygiene  proposed  in  197^  that  counties  using  state-services  should  place  in  one 
computer  file  information  on  each  individual  in  the  county  using  a  state-financed 
service  for  mental  health,  alcoholism,  drug  abuse,   or  mental  handicap.     Instead  of 
four  separate  record  systems,  as  previously  maintained  by  the  county  agencies 
involved  in  furnishing  these  services,  there  would  be  one  set  of  forms  for  all  the 
services — admissions,   evaluations,  scheduling,  etc., — and  one  information  system 
for  storing  and  using  the  data.     Client  numbering  would  be  changed  so  that  only  one 
client  number  would  be  used  regardless  of  the  service  provided.     The  client  number 
and  case  data  on  clients  would  then  be  sent  to  the  state's  computerized  file  for 
program  evaluation,  auditing,  etc. 

When  this  proposal  was  presented  in  Milwaukee  by  the  administrator  of  the 
County  Unified  Services  Board,   it  drew  strong  opposition  from  mental  health  agencies, 
social  services  groups,  and  the  Wisconsin  ACLU.     When  the  plan  was  first  announced 
in  May  of  197^»  the  ACLU  consulted  with  state  and  county  officials  and  concluded 
that  no  overriding  need  for  the  data  had  been  demonstrated  that  would  justify  the 
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K       threats  to  privacy  and  confidentiality,  and  it  called  for  a  halt  to  implementation 
||       of  the  databank.     The  ACLU  set  out  a  list  of  safeguards  that  it  felt  should  be 
provided  before  such  a  system  should  go  forward: 

1.  The  right  to  inspect  any  information  about  herself/himself  in  the 
record  system. 

2.  The  right  to  contest  the  accuracy  of  the  information,  to  correct 
errors,  and  to  have  such  corrections  recorded  in  the  file  and 
reported  to  all  those  who  have  received  the  wrong  data. 

3.  The  right  to  place  explanatory  information  in  his/her  file. 

4.  The  right  to  know  the  administrative  policies  and  procedures 
governing  the  maintenance  and  use  of  her/his  file. 

5.  The  right  to  know  the  remedies  available  to  her/him  when  he/she 
wishes  to  challenge  information.     Individuals  should  learn  this 
information  from  the  agency  at  the  earliest  opportunity  after  the 
decision  has  been  made  that  a  file  will  be  kept  on  the  person's 
case . 

6.  The  right  to  be  heard  in  person  on  any  substantial  issue  concerning 
,  the  record  and  the  right  to  a  statement  of  reasons  if  a  decision 

!  •  unfavorable  on  the  claim  of  the  individual  is  made. 

?•     The  citizen  must  be  notified  upon  each  release  of  information  to 
an  outside  agency  or  party  and  upon  any  inter-agency  transfer  of 
i  records. 

In  August  of  197^1   the  administrator  of  Unified  Services  presented  a  revised 

proposal  for  a  county  index.     A  computer  program  would  transform  a  client's  namie  and 

pi      birthdate  into  a  number  and  would  store  records  under  that  number,  but  would  not  have 

i"':-     the  name  connected  with  the  data.     Each  agency  under  contract  to  the  Board  would  have 

I;,      a  terminal  in  its  offices  so  that  it  could  put  the  client's  name  and  birthdate  in  and 

I  •      set  a  number  back  for  record  purposes.     Only  the  individual  agency  would  know  both 

[•;:       the  name  and  the  number,  and  reports  on  clients  sent  to  the  state's  computer  system 

[:  '      would  be  identified  only  by  number.     To  catch  duplications — perhaps  the  prime  purpose 

i         of  the  unified  data  system — coordinators  at  the  county  computer  operation  would  check 

'      when  names  were  submitted  for  numbers  to  see  whether  other  agencies  had  reported 

having  that  individual  with  them,  and  would  check  to  see  whether  this  represented 

'         "unnecessary  duplication  of  services." 

;  '  This  revised  system  was  still  opposed  by  the  groups  that  had  criticized  the 

I         earlier  plan,   including  the  Mental  Health  Planning  Council,  Alcoholics  Anonymous,  and 

the  Wisconsin  ACLU.     The  terminal  feature,  they  said,  would  mean  that  employees  and 
:         anyone  else  who  could  gain  physical  access  to  agency  offices  could  play  with  the 

numbers-and-name  system,  and  that  there  still  had  been  no  proof  shown  that  a  single 
;;         numbering  system  on  clients  was  necessary  to  plan  services  and  avoid  duplication. 

Comment 

The  Central  Databank  concept  translates  into  reality  the  previously  expressed 
'  ,.       fears  of  critics  about  controlled  dissemination  of  identified  information  from  one 
i '       government  agency  to  another.     The  recounting  of  the  events  surrounding  the  creation 
of  these  two  data  banks,  and  the  debate  over  the  adequacy  of  notice,  consent, 
;       challenge,  and  correction  in  such  systems  highlights  the  citizen      rights  problems 
':  ii       these  types  of  systems  present.     One  point  about  such  central  data  banks  deserves 

i       special  emphasis.     It  is  a  point  that  we  have  noted  in  passing  when  describing 
'■  !       smaller  computerized  systems,  but  that  has  a  special  relevance  for  a  large. 
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complicated  multi-level  data  bank.     The  process  that  takes  place  here  is  that  first 
the  databank  is  created;  then  protests  arise  from  civil  liberties  groups  and 
professional  associations;  then  the  government  agency  often  tries  to  make  some 
accommodation  to  the  complaints,  usually  with  limited  success.     The  accommodation  is 
bound  to  be  of  limited  success  because  the  reforms  are  tacked  on  as  an  afterthought, 
and  are  not  really  viewed  by  officials  as  an  integral  part  of  the  system.     Until  ajnd 
unless  such  citizen    rights  considerations  are  included  in  the  earliest  planning  for 
data  banks,  seeking  the  widest  acceptance  from  all  segments  of  the  commimity, 
recognition  given  later  will  be  regarded  by  critics — rightly — as  something 
grudgingly  granted,  and  distrust  will  greet  even  well-meaning  efforts  by  government 
officials — as  an  afterthought — to  safeguard  these  systems  properly. 

In  discussing  the  problems  connected  with  various  computerized  systems,  vie  have 
focused    primarily  on  the  lack  of  protections  for  confidentiality;  less  attention  has 
been  given  to  the  questions  of  an  individual's  right  of  access.     In  only  half  a 
dozen  of  the  episodes  recounted  here  was  the  question  of  access  raised  at  all  by 
concerned  groups;   in  only  two  of  them  was  it  given  equal  weight  or  more  weight  than 
protests  about  confidentiality.     This  conforms  to  the  patterns  already  established 
with  manual  health  records,  where  fewer  protests  have  traditionally  been  made  over 
lack  of  access  than  over  breaches  of  confidentiality.     However,  in  the  past  few  years, 
there  has  been  a  growing  consciousness  that  individuals  do  have  a  right  of  notice 
and  access  when  records  are  collected  and  used  to  make  governmental  or  consumer 
judgments  about  them. 

But  in  the  cases  of  computerized  health  records  we  have  been  discussing,  most 
of  the  individuals  whose  records  are  included  are  probably  not  aware  of  their 
existence.     A  right  of  access — even  if  it  were  to  be  established — would  be 
meaningless  unless  accom.panied  by  the  right  of  notice,  and  this  raises  several 
troublesome  questions  t 

1  .     Host  individuals  receiving  care  in  hospitals  and  clinics  know  that  sumiiar;' 
infomation  about  them — length  of  stay,  diagnosis,  identifying  material,  etc.  —  is  being 
recorded  about  them  by  primary  care  providers.     But  patients  usually  have  no  idea  it  is 
being  computerized  and  sent  outside  the  facility  for  various  "special  uses."  Several 
of  our  episodes,  such  as  the  fetal  register  and  the  abortion  register  fall  into  this 
category. 

2.  Most  individuals  seeing  private  physicians  know  that  detailed  sensitive  infor- 
mation confided  to  their  doctors  may  be  recorded  by  them.     But  they  have  no  idea  that 
some  of  this  sensitive  information  is  also  being  computerized  and  forwarded  to  state 
health  agencies.     The  New  York  State  Department  of  Hygiene  and  Missouri  data  reports 
fall  into  this  category. 

3.  There  are  situations  in  which  individuals  have  no  idea  that  information  or 
judgments  (whether  medical  or  pseudo-medical)  is  being  recorded  about  them  at  all,  and 
no  idea,  therefore,  that  such  judgments  are  being  centrally  computerized.     The  Maryland 
DSH  system  and  those  child  abuse  registries  without  notice  provisions  are  examples  of 
this . 

4.  There  are  individuals  who  have  an  affirmative  reason  to  believe  that 
information  about  them  is  not  being  recorded  and  transmitted  elsewhere,  as  is  the 
case  with  juvenile  offenders  who  fall  under  the  protection  of  the  Youthful  Offender 
Act  and  its  state  counterparts,  but  such  persons  are  mistaken  in  their  belief. 
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For  a  concept  of  adequate  notice  to  be  effective,   it  would  not  only  have  to 
inform  the  individual  that  personal  information  was  being  forwarded  to  a  named 
centralized  data  system,  but  would  also  have  to  indicate  what  other  agencies  have 
access  to  it,  so  that  the  individual  might  know  where  his/her  records  are  which 
might  require  correction  or  updating. 

We  noted,  when  discussing  manual  records,  that  the  greater  the  dissemination  of 
medical  records  into  areas  where  they  played  an  evaluative  role — in  employment, 
licensing,  law  enforcement  etc. — the  more  important  was  the  question  of  access,  with 
the  opportunity  to  correct  errors.     Centralized  computerization  heightens  this 
importance  in  direct  proportion  to  its  greater  capacity  to  disseminate  personal 
information  to  a  broad  variety  of  agencies  and  institutions  which  make  such 
evaluative  decisions. 

Two  special  problems  of  computerization  that  do  not  fit  into  the  categories 
already  outlined  deserve  mention  here: 

26 

Incident;  The  California  and  Michigan  Beneficiary  Explanation  Programs 

Improper  or  fraudulent  claims  by  doctors  have  been  a  concern  of  the  federal 
!\'edicare  and  Medicaid  programs  since  their  inception,  as  well  as  of  state 
supplementary  payment  programs  such  as  California's  MediCal.     To  improve  the 
efficiency  and  monitoring  of  claims  processing,  the  Federal  government  pays  any  state 
that  installs  an  approved  computerized  claims  processing  and  information  system  90fo 
of  the  cost  of  installing  the  system  and  75%  of  its  operating  costs.     One  of  the 
conditions  the  state  must  meet  is  a  "beneficiary  explanation  program"  in  which  a 
notice  is  sent  to  the  home  of  recipients  listing  the  medical  service  reported  to 
have  been  performed  and  requesting  recipients  to  notify  the  state  if  any  of  these 
services  were  not,   in  fact,  delivered. 

The  beneficiary  explanation  program  has  been  used  extensively  by  states  such 
as  Michigan  and  California  as  part  of  their  computerized  claims  processing  systems. 
In  a  four  month  period  in  Michigan,  for  example,  the  state  sent  beneficiaries 
1.7  million  such  forms. 

In  197^,   two  15  year  old  girls  had  medical  abortions  paid  for  by  MediCal. 
Joined  by  several  organizations,  the  two  girls  sued  in  federal  district  court  to 
enjoin  California  from  mailing  notices  to  their  homes.     They  charged  that  the 
notices  for  all  MediCal  recipients  in  a  given  household  were  sent  in  a  single 
envelope,  and  that  the  abortion  information  would  thus  be  available  to  their  parents, 
even  though  California  law  protects  the  right  of  minors  to  abortion  (and  other 
medical  treatment)  without  parental  notice  or  consent.     The  lawsuit,  filed  as  a 
class  action,  also  contends  that  the  beneficiary  notification  program  would 
"discourage  poor  people  from  obtaining  necessary  medical  services  such  as  venereal 
disease  treatment,  contraceptives,  pregnancy  or  abortion  services,  drug  and 
alcoholic  treatment,   or  psychiatric  counseling." 

The  lawsuit  also  charges  that  the  results  that  had  been  achieved  thus  far  under 
the  recipient  notification  program  did  not  justify  its  invasive  aspects.     Out  of  the 
1.7  million  notices  sent  out  in  Michigan,  only  2,100  produced  communications  from 
recipients  raising  questions  about  the  services  listed  for  them.     Paul  Allen,  director 
of  the  Medicaid  administration  for  Michigan  declared  that  the  program  has  not  "proved 
cost  effective." 
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Comment 

This  seems  to  be  a  minor     organizational  problem,  requiring  more  sensitive 
procedures  (such  as  using  first-class  mail  for  the  notices)  and  more  sensible  methods 
(such  as  using  random  sampling  in  selecting  records  rather  than  wholesale  mailings). 
It  is  noteworthy  because  it  is  yet  another  instance  of  how  consciousness  of  citizen 
rights  issues  in  the  planning  stages  could  have  avoided  controversy. 

27 

Incident;  The  Maryland  Drug  Abuse  Administration 

In  March  of  197^,  the  Baltimore  press  reported  that  several  employees  of  the 
Maryland  (State)  Drug  Abuse  Administration(DAA)  had  been  arrested  by  city  and  state 
police  and  charged  with  drug  violations  involving  use  of  narcotics  "at  or  near  the 
drug  abuse  headquarters."    The  news  stories  disclosed  that  an  informant  had  notified 
the  director  of  the  DAA  several  months  previously  that  some  employees  of  the  agency 
had  been  using  narcotics  at  "a  party."     The  Director,  L.  Robert  Evans,  consulted  with 
Dr.  Neil  Solomon,  head  of  the  State  Health  Department,  who  informed  Governor  Mandel 
of  the  situation.     The  decision  was  made  to  send  an  undercover  state  police  agent 
into  the  Drug  Abuse  agency,  posing  as  an  employee  working  in  the  planning  section. 
He  worked  there  for  approximately  six  weeks,  and  information  he  developed  led  to  the 
arrests . 

These  disclosures  led  to  a  series  of  meetings  in  March  and  April  by 
representatives  from  local  and  statewide  drug  and  alcohol  treatment  programs, 
medical  groups,  hospitals,  and  the  Maryland  ACLU,  based  on  threats  to  the 
confidentiality  of  client  information  posed  by  such  undercover  activity.     A  Maryland 
Committee  on  Client  Confidentiality  was  formed,  and  a  statement  issued  that  called  on 
the  Governor  to  see  that  no  undercover  agents  would  thereafter  "be  introduced  into 
any  phase  of  the  Maryland  drug  treatment  and  rehabilitation  system."    The  Statement 
explained  that  these  organizations  "do  not  condone  nor  do  they  wish  to  defend  the 
alleged  illegal  use  of  drugs  by  the  individuals  ajrrested."    However,  placement  of  a 
police  undercover  agent  in  the  state  drug  abuse  treatment  agency  disrupts  the 
"trusting  relationships"  between  client  and  counselor,  and  among  agencies; 
jeopardized  the  security  of  the  drug-abuse  registry  and  other  confidential  records 
kept  at  DAA;  and  "demonstrated  judgment  incompatible  with  continued  trust  of  the 
Drug  Abuse  Administration  by  local  programs." 

In  meetings  with  the  concerned  groups,  DAA  Director  Evans  stated  that  using  an 
undercover  police  agent  was  "the  best  investigative  method"  possible  and  "the  only 
way  to  root  it  out."     He  said  that  the  agent  had  been  given  "specific  instructions" 
not  to  have  anything  to  do  with  client  records  and  other  confidential  data.     In  fact, 
he  added,  the  staff  members  arrested,  because  of  their  drug  use,  were  unreliable 
persons  to  continue  to  have  access  to  the  confidential  information. 

These  explanations  were  not  considered  adequate  by  the  protesting  groups  and 
the  controversy  deepened.     Dr.  William  C.  Ebeling,  head  of  the  state  university 
medical  faculty  and  its  medical  society,  sent  Governor  Mandel  a  communication 
charging  that  employees  of  DAA  had  made  certain  records  from  the  confidential  Narcotic 
Addict  Registry  available  to  the  agent.     (The  registry  lists  all  persons  being 
treated  in  6o  centers  throughout  the  State.)     Dr.  Ebeling's  complaint,  plus  those  of 
13  private  drug  treatment  programs,   led  the  state  health  department  to  order  an 
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investigation  of  the  incident  in  early  April. 

As  a  result  of  the  investigation,  authority  over  record-keeping  by  DAA  was 
shifted  from  the  agency's  director  to  its  medical  director,  Dr.  Samuel  L.  Fox.  Dr. 
Fox  announced  in  August  of  197^  that  he  was  destroying  all  records  accumulated  by 
DAA  over  the  past  five  years  that  identified  drug  users  by  name,  leaving  the 
originals  of  those  records  only  in  the  local  programs.     He  also  modified  proposed  DAA 
regulations  which  would  have  required  names  to  be  sent  to  the  state  and  set  up 
a  coding  system  instead.     The  Maryland  Association  of  Mental  Health  and  other  groups 
hailed  the  new  policy,  and  John  Roemer,  director  of  the  state  ACLU,  praised  the 
decision  as  "a  large  step  forward  in  protecting  both  privacy  and  rehabilitation." 

However,  the  question  of  whether  police  would  be  used  in  the  future  as  undercover 
agents  in  drug  programs  and  other  sensitive  social-rehabilitation  programs  was  not 
addressed  by  the  Governor,  or  any  state  health  officials.     John  Roemer  noted  that 
the  1974  incident  ought  to  be  a  warning  that  no  state  registry  or  record-system  could 
be  considered  secure  and  its  data  confidential  if  the  "needs  of  law  enforcement" 
prompted  its  keepers  to  allow  such  undercover  penetration  by  the  police.     "There  is 
no  guarantee  that  such  an  agent  would  not  look  at  the  records  if  that  would  help  in 
the  investigation,  and  it  would  be  almost  beyond  human  nature  for  such  an  agent  to 
resist  a  peek  at  the  files  for  a  wide  range  of  police  Investigation." 


Comment 

We  have  tried  to  avoid  as  far  as  possible  the  "what  if?"  approach  to 
computerization,  and  to  confine  our  analysis  to  factual  episodes.     However,  the 
placement  of  an  undercover  agent  in  the  proximity  of  supposedly  confidential  files 
speaks  to  all  the  fears  generated  by  the  Nixon-White  House  plumbers,  the  burglary 
of  Dr.  Fielding's  office,  smd  the  complex  of  issues  raised  by  Watergate.     It  cannot 
help  but  evoke  the  question:  What  if  the  need  were  compelling  enough — say  a  threat 
to  the  President's  life,  or  the  danger  of  a  mass  terrorist  bombing?    V/ould  any 
system,  even  one  like  MSIS,  protected  by  special  statute,  be  secure  against 
encroachment  by  law  enforcement  officers?    And  if  such  "appealing"  situations  were 
held  to  justify  law  enforcement  access,  then  who  among  state  or  federal  health 
officials  would  have  the  power — and  the  incentives  and  guts —  to  inquire  into  the 
declaration  of  such  "special  needs"  by  law  enforcement  officials? 

The  answer  to  this  and  other  "what-if"  questions  lieS  in  the  adoption  of 
specific  protective  statutes,  and  of  special  review  bodies  to  pass  on  requests  for 
exemptions  or  exceptions.     But  it  also  requires  a  deepening  of  societal  attitudes, 
through  court  decisions,  greater  public  familiarity  with  the  dangers  as  well  as  the 
benefits  of  computerization,  and  greater  sensitizing  of    public  officials  directing 

government  health  and  social  services.     The  ways  of  fostering  such  attitudes  will  be 

discussed  in  the  concluding  section  of  this  report. 
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Incident!  The  Medical  Information  Bureau 

So  far,  we  have  confined  our  reports  to  incidents  of  government  computerization, 
which  is  where  most  public  attention  has  been  focused.      But  the  problems  of 
computerization  are  raised  as  well  by  some  private  organizations.     As  an  example,  we 
will  return  to  the  Medical  Information  Bureau,  whose  operations  have  been  described 
earlier  in  Part  I . 

The  MIB  system  was  a  manual,  card-index  operation  for  the  first  sixty-odd  years 
of  its  existence  J  in  the  late  60's  it  was  processing  10-15  million  information 
requests  annually  from  its  700  member  life  insurance  firms.     In  1970,  MIB  automated 
its  files.     It  presently  uses  a  service  bureau  in  Boston  to  store  data  on  some 
11  million  persons  who  have  previously  applied  for  life  insurance,  and  to  handle 
requests  for  reports. 

There  was  no  change,  as  a  result  of  automation,  in  the  kind  or  extensiveness  of 
the  data  that  MIB  collected,  stored,  and  distributed  to  its  member  companies.  But 
the  fact  that  MIB  was  not  known  to  the  public,  and  especially  to  individuals  who 
might  be  denied  life  insurance  or  rated  more  highly  by  a  life  insurance  company 
because  of  information  supplied  by  MIB,  prompted  widespread  criticism  in  the  late 
1960's  and  early  1970 's  from  consumer  advocates,  civil  liberties  groups,  and 
Congressional  spokespersons.     The  fundamental  criticisms  were  over  the  kind  of 
"social  data"  that  MIB  had  been  collecting  and  disseminating  (sexual  behavior, 
finances,  life  style,  mental  "impairments,"  etc.);  the  lack  of  any  provision  for  a 
person  to  inspect,  challenge,  and  correct  the  information  in  his/her  records  and 
the  capacity  of  member  life  insurance  firms  who  also  write  accident,  health  and 
auto  policies  to  obtain  use  of  MIB  data  for  those  purposes  even  though  MIB  rules 
said  they  should  not  do  this.     The  fact  that  the  Fair  Credit  Reporting  Act  of  1970 
contained  an  exemption  for  medical  data  meant  that  MIB  was  not  covered  by  the 
notification  and  access  protections  of  that  law,  and  this  generated  extensive 
criticism  in  hearings  before  Senator  Hart  in  1972  and  Senator  Proximire  in  1973, 
and  in  both  the  medical  and  general  press. 

MIB  reacted  both  slowly  and  defensively  to  these  complaints.     In  November,  1974, 
it  did  stop  collecting  information  about  "sexual  deviation"  and  "social  maladjustment". 
In  an  interview  in  the  Baltimore  Sun  on  July  13,  1975,  Joseph  C.  Wilberding,  MIB 
Executive  Director,  stated  that  the  Bureau  had  voluntarily  eliminated  these 
categories  from  its  "impairment"  category.     Instead,  it  substituted  two  new 
categories  that  would  alert  an  inquiring  company  of  the  "existence"  of  such 
information.     "All  that  is  reported  now,"  Mr.  Wilberding  explained,   "is  that  company 
X  thinks  they  got  significant  information  from  an  unidentified  investigative  report. 
They  are  not  reporting  information,  but  they  are  reporting  the  possible  existence  of 
information  that  must  be  further  checked  out."    This  left  many  critics  unimpressed. 

In  August,  1974  MIB  announced  that  insurance  applicants  would  henceforth  be 
told  in  writing  by  MIB  member  firms  that  health  data  they  supplied  would  be 
submitted  to  MIB  for  storage  in  its  computer  system  and  might  later  be  shared  with 
life  insurance  firms  using  the  system.* 

*  Footnote  on  top  of  next  page 
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*    An  example  of  this  new  procedure  is  the  notice  used  by  Union  Fidelity  Life 
Insurance  Company: 

IMPORTANT  NOTICE 
Information  regarding  your  insurability  will  be  treated  as 
confidential.     Union  Fidelity  Life  Insurance  Company  may,  however, 
briefly  report  to  the  Medical  Information  Bureau  on  information 
received  with  your  application.     The  Bureau*,  on  request  from 
a  member  company  to  whom  you  may  apply  for  insurance,  or  from 
whom  you  may  claim  benefits,  will  supply  such  information  to 
the  company.     If  you  ask, the  Bureau  will  arrange  to  disclose 
the  information  in  your  file  (medical  information  will  be 
disclosed  only  to  your  attending  physician),  and  you  may  seek 
to  correct  any  inaccuracy  in  accordance  with  the  Fair  Credit 
Reporting  Act  procedures. 

Union  Fidelity  Life  Insurance  Company  may  also  release  information 
in  its  file  to  other  life  insurance  compcinies  to  whom  you  may 
apply  for  life  or  health  insurance  or  to  whom  you  submit  a  claim 
for  benefits.     Union  Fidelity  Life  Insurance  Company  will  not, 
however,  reveal  to  another  company,  or  to  the  Bureau,  the  action 
taken  on  the  basis  of  your  current  request  for  insurance. 

*A  non-profit  membership  organization  of  life  insurance  companies 
which  operates  an  information  exchange  for  its  members.  P.O.Box 
105,  Essex  Station,  Boston,  Mass.  02112,  telephone  6l7-iJ-26-3660. 

MIB  also  provided  that  an  applicant  for  insurance  who  wished  to  review  his/her  file 
might  do  so  by  asking  that  the  information  be  forwarded  to  the  insurance  company  to 
which  the  application  had  been  made.     That  company  would  then  make  it  available  to 
the  attending  physiciaji,  who  could  review  it  with  the  applicant.     Correction  of  any 
erroneous  data  would  be  made  in  general  conformity  to  the  procedures  of  the  Fair 
Credit  Reporting  Act. 

These  procedures  were  still  met  by  criticism.     It  was  argued  that  the  notice 
ought  to  be  printed  on  the  insurance  application  itself,  and  that  access  should  be 
available  to  the  individual  directly,  not  filtered  through  the  insurance  compajiy  and 
through  the  "attending  physiciam." 

In  1975,  MIB  further  broadened  its  access  policies.     Now,  individuals  could  ask 
to  see  their  MIB  record  directly,  and  could  do  so  upon  providing  identifying  data, 
and  supplying  a  detailed  history  of  previous  insurance  applications.     Any "non-medical 
information "in  the  file  would  be  released  directly  to  the  individual,  by  reversed- 
charge  telephone  call  or  personal  appointment.     Medical  information  would  be  disclosed 
only  to  the  individual's  personal  physician.     To  obtain  the  medical  information,  a 
release  had  to  be  signed  freeing  MIB  or  its  member  companies  from  any  liabilities  or 
damages  in  connection  with  the  information.     This  release  applied  to  medical 
information  released  to  the  individual,  and  was  based  on  the  fact  that  MIB  had  no 
obligation  under  the  Fair  Credit  Reporting  Act  to  disclose  its  record  to  the 
individual. 

To  the  criticism  that  medical  records  may  be  disseminated  to  unauthorized 
individuals  or  misused,  MIB  points  to  its  rules  that  prohibit  the  transmission  of 
medical  information  to  life  insurance  compemies  unless  accompanied  by  a  signed 
authorization,  and  which  prohibit  life  insurance  companies  from  rejecting  an 
applicant  solely  on  the  basis  of  a  negative  MIB  report.     In  the  interview  cited  above, 
however,  Mr.  Wilberding  conceded  that  the  Bureau  has  only  two  employees  to  review  the 
19  million  requests  for  MIB  reports  each  year,  and  that  in  a  period  of  more  than  two 
years  it  was  able  to  review  the  general  procedures  for  compliance  of  less  than  30%  of 
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its  716  member  compeinies. 


Comment 

MIB  first  attracted  attention  in  the  mid-l960's,  when  legislative  committees 
axid  writers  on  privacy  began  to  publicize  the  presence  of  this  central  registry  of 
medical  and  non-medical  information  for  life  insurance  companies.     Yet  it  was  not 
until  1974  that  MIB  modified  its  use  of  "non-medical"  data,  and  not  until  1974  that 
it    adopted  policies  for  notice  and  access  that  meet  what  almost  all  observers  would 
regard  as  fair  procedures  to  protect  the  interests  of  life  insurance  applicants. 
That  MIB  is  now  taking  some  corrective  steps  is  praiseworthy;  but  that  it  took 
agitation  by  critics  for  almost  a  decade  to  produce  organizational  responsibility 
does  not  speak  well  for  MIB,  for  the  life  insurance  industry,  for  the  public 
officials  in  the  state  legislatures  where  MIB  is  chartered  (Connecticut)  or  has  its 
files  (Massachusetts),  or  for  Congress,  which  ought  to  have  written  careful 
provisions  to  protect  consumer  rights  affected  by  the  MIB  data  bank  when  it  enacted 
the  Fair  Credit  Reporting  Act  in  I97O. 

29 

Incident;  The  Georgia  "Free  Consent"  Experiment 

When  government  agencies  computerize  health  and  welfare  client  records,  and 
when  professional  groups  or  civil  liberties  organizations  raise  questions  about  the 
confidentiality  or  security  of  the  client  data  that  will  be  stored,  two  typical 
responses  are  made  by  the  systems  managers:     (1)  only  authorized  personnel  and 
legitimate  users  will  have  access  to  the  data,  and  (2)  the  clients  themselves  are  not 
worried  about  violations  of  the  privacy  of  their  records;     this  is  mainly  a  case 
of  overblown  fears  by  self-appointed  defenders.     When  it  is  pointed  out  that  clients 
asked  to  give  their  consent  to  have  health  and  welfare  data  sent  to  state  computer 
systems  do  not  really  have  a  free  choice — since  they  might  jeopardize  their  benefits 
if  they  refused  consent — the  answer  is  that  no  one  really  objects. 

An  important  experiment  testing  this  assumption  was  performed  at  a  Community 
Mental  Health  Center  in  Georgia  during  197^-75.     Before  July  of  197^,  reports  of 
services  rendered  by  the  community  centers  were  sent  to  the  State  Division  of  Mental 
Health  identified  only  by  case  numbers.     For  that  reason,  no  need  was  felt  to  inform 
clients  that  information  on  them  was  being  sent  from  the  local  center  to  "the  state 
computers. " 

On  July  1,  197^»  Georgia  directed  mental  health  clinics  and  centers  to  send  in 
for  each  new  client  his/her  name, Social  Security  number,  primary  disability,  previous 
mental  health  services,  diagnosis,  and  other  personal  background  data.     Dr.  Catherine 
E.  Rosen,  director  of  research  and  evaluation  at  the  Northeast  Georgia  Community 
Mental  Health  Center  (in  Athens,  Georgia)  saw  this  as  an  opportunity  to  test  how 
clients  really  felt  about  releasing  their  personal  data.     She  designed  an  experiment 
that  would  see  what  clients  would  do  if  they  felt  they  had  a  real  choice  in  this 
matter. 

The  center's  lawyer  prepared  a  Medical  Release  Authorization  Form  that  read  as 
follows : 
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"The  undersigned  patient  hereby  authorizes  the  Northeast 
Georgia  Community  Mental  Health  Center  to  furnish  the 
Division  of  Mental  Health  of  the  Georgia  Department  of 
Human  Resources  a  record  or  records  including  the 
following  information:  patient's  name,  social  security 
number,  and  nature  of  patient's  primary  disability. 
Nothing  herein  shall  authorize  the  Northeast  Georgia 
Community  Mental  Health  Center  or  the  Georgia  Department 
of  Human  Resources  to  release  said  records  to  the  general 
public,  as  is  prohibited  by  Section  ^0-2703,  Code  of 
Georgia." 

During  Phase  I  of  the  experiment, from  July  of  197^  to  March  of  1975 #  each  of  the 
962  clients  in  the  Center's  four  clinics  were  presented  with  the  form  and  signed  it. 
(Illiterate  clients  had  it  read  to  them,  and  clients  too  distraught  to  deal  with  the 
form  on  intake  had  it  presented  later).     Compliance  was  100^.     No  one  declined  to 
sign. 

During  Phase  II,  from  March  to  September  of  1975.  the  Medical  Release 
Authorization  Form  was  still  given  to  clients  to  read.     But  then  different  additional 
procedures  were  employed.     In  two  clinics,  a  "no  option"  statement  was  read  aloud  to 
the  client.     This  said: 

"The  State  wants  to  keep  a  record  of  name,  social  security  number,  and  the  type 
of  problem  of  every  person  who  comes  for  mental  health  services.     The  reason  why  the 
state  wants  this  information  is  so  that  it  can  keep  track  of  mental  health  services 
and  clients  throughout  the  state.     If  you  sign  this  paper  it  means  you  give  us 
permission  to  send  in  your  name,  social  security  number,  and  diagnosis  into  the  state 
offices  in  the  capitol,  where  it  will  be  placed  in  the  Mental  Health  computer  file." 

In  the  Center's  other  two  clinics,  this  statement  was  also  read  but  it  was 
followed  by  an  additional  statement  suggesting  that  the  client  has  a  genuine  option. 
This  stated: 

"If  you  do  not  sign  this  paper,  this  identifying  information  will  not  be  sent 
into  the  state  offices  in  the  capitol  and  will  be  kept  only  locally.     In  other  words, 
if  you  don't  sign  you  will  get  the  same  services  from  us  as  if  you  did  sign." 

In  all  the  clinics,  a  pen  was  placed  on  the  table  after  the  reading  of  the 
statement  so  that  the  client  could  make  his/her  decision. 

In  the  two  clinics  where  109  clients  heard  only  the  "no  option"  statement, 
compliance  was  10Q%i  everyone  signed.     But  in  one  of  the  two  clinics  where  both 
statements  were  read,  compliance  among  259  clients  dropped  to  41%.     In  the  other, 
compliance  among  104  clients  dipped  to  20%.*    Analysis  of  the  non-compliers  showed 
them  to  be  more  often  females  and  better  educated,  but  there  were  not  significant 
differences  in  other  variables,  such  as  age,  race,  income,  apparent  nervousness, 
severity  of  problem,  etc. 


*In  the  clinic  scoring  41%  compliance,  a  clerk  presented  the  options  the  clinic 

having  20%  compliance  had  the  clinician  present  it.     Dr.  Rosen  believes  that  the 

willingness  to  withhold  consent  rose  when  the  person  who  would  provide  the  client 

with  the  mental  health  service  he/she  wanted  said  that  there  would  be  no  lessening 
of  service. 
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The  spontaineous  remarks  made  by  clients  when  presented  with  the  "option" 
statement  left  no  doubt  what  was  in  their  minds  in  refusing  to  sign.  Concern 
was  expressed  about  the  effect  of  forwarding  the  information  on  the  clients'  current 
or  future  employment,  possible  loss  of  custody  of  their  children,  and  fears  about 
the  information  being  used  against  them  later  for  some  government  purpose. 

Comment 

Dr.  Rosen's  study  provides  striking  proof  of  what  civil  libertarians  have  been 
asserting  for  years — that  the  millions  of  persons  who  are  clients  of  government 
health  services  do  care  about  the  circulation  of  their  personal  data,  and  that  their 
consent  would  not  be  freely  obtained  for  many  inadequately  protected  government  data 
systems  if  clients  really  had  adequate  notice  of  what  was  to  be  done  amd  felt  they 
had  a  real  choice  of  whether  to  consent  or  not.     After  Dr.  Rosen  ""s  study,  it  ought 
to  be  suggested  to  every  proponent  of  a  sensitive  data  system,  especially  the 
computerized  ones,  that  they  administer  the  type  of  "real  option"  statement  that 
Dr.  Rosen  used  to  a  sample  of  those  persons  whose  records  would  go  into  the  system. 
Only  when  a  substantial  majority  gave  such  consent  should  the  proponents  be  allowed 
to  assert  that  "people  don't  object  to  having  their  data  in  our  fine  system." 

OVERALL  CONCLUSIONS  ABOUT  "COMPUTER  IMPACT" 

All  the  incidents  we  have  presented  in  this  chapter  arose  from  Zone  2  or  Zone  3 
activities — uses  of  computerized  medical  records  or  health  data  for  utilization 
reviews  or  to  make  evaluative  "non-medical"  judgments  about  individuals.     But  the 
sources  of  the  data  in  many  such  cases  were  computer  files  maintained  by  primary 
care  providers  in  Zone  1,  and  thus  collection  and  storage  there  has  to  be  viewed  in 
light  of  the  demands  for  production  of  identified  data  being  made  by  the  Zone  2  and 
3  activities. 

Our  analysis  of  these  incidents  suggests  some  almost  painfully  simple 
conclusions.     Most  computerized  health  data  systems  are  being  created  or  expanded 
without  sufficient  consultation  in  advance  with  groups  representing  citizens  rights 
and  doctor-patient  interests,  and  without  some  kind  of  proceeding  open  to  the 
general  public.     Most  data  systems  lack  sufficiently  developed  analyses  of  how  much 
amd  what  kind  of  identified  personal  data  they  really  need  to  perform  their  function. 
Even  when  properly  defined,  most  data  systems  fail  to  adopt  sufficiently  precise 
standards  of  confidentiality,  controlling  uses  within  the  organization  emd  releases 
of  identified  data  to  third  parties.     When  it  comes  to  rules  for  permitting  patient 
access  to  their  own  records,  very  few  computerized  organizations  have  adopted 
procedures  responsive  to  those  patients  who  ask  for  and  insist  upon  access. 

Noting  these  general  defects  is  not  to  say  that  there  are  no  real  problems  of 
conflicting  values  or  hard  choices  of  social  priority  involved.     Indeed  there  are, 
and  that  is  what  we  will  take  up  in  our  final  chapter.     But  we  approach  this  task 
of  discussing  alternative  policies  and  making  recommendations  with  the  judgment  that 
both  citizen    rights  and  effective  use  of  computer  resources  require  that  we  move 
away  from  ambiguous  and  ill-defined  systems  that  leave  people  uncertain  and  fearful 
about  their  capacity  to  control  the  circulation  of  their  medical  and  health  data. 
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CHAPTER  12.    COMPARISONS  WITH  OTHER  DEMOCRATIC  NATIONS 


Before  considering  policy  alternatives,  it  is  helpful  to  compare  American 
developments  with  regard  to  medical  automation  and  citizen  rights  with  trends  in 
other  democratic  nations.     While  we  did  not  study  the  situation  in  other  countries 
with  the  intensity  that  we  did  for  the  United  States,  we  did  develop  a  combination  of 
published  sources,  personal  interviews,  correspondence  with  government  health  agencies 
and  medical  societies,  and  visits  to  selected  countries  on  which  to  base  some  useful 
comparative  observations. 

Health  care  patterns  reflect  national  cultures.     Among  advanced  industrial 
nations  with  parliamentary  institutions,  this  leads  to  diversity,  for  example,  in  how 
much  of  the  gross  national  product  is  put  into  health  care,  how  the  health  delivery 
system  is  organized  and  financed,  the  scope  of  services  made  available  to  the 
citizenry  if  there  is  a  national  health  insurance  plan,  the  roles  played  by  central 
and  local  government,  the  type  of  administration  over  public  and  private  health 
institutions,  and  the  degree  of  regionalization  that  is  used  for  health  services. 
There  are  also  important  differences  in  law  and  administrative  tradition  among 
democratic  nations  that  will  affect  automation  in  health  care,  as  with  the  presence 
in  countries  such  as  Sweden  and  Israel  of  a  national  citizen  number  that  facilitates 
record  linkage  along  regional  or  national  lines. 

Along  with  such  national  differences,  there  are  also  many  common  elements  in 
the  health  systems  of  industrialized  democracies.     The  percentage  of  gross  national 
product  spent  on  health  care  has  been  rising  steadily  in  these  nations  during  the 
past  decade,  along  with  public  expectations  that  providing  access  to  health  care  is 
a  public  responsibility.     A  concentration  on  preventive  medicine,  outpatient  care, 
and  regional  coordination  has  also  been  common  to  mamy  national  scenes.  More 
generally,  the  concepts  of  medicine,  the  organization  of  practice  into  specialties, 
and  techniques  of  medical  procedure  are  widely  followed  in  Western  societies,  while 
the  status  and  attitudes  of  medical  professionals  as  an  occupational  group  and  the 
organization  of  hospitals  and  clinics  as  institutions  also  exhibit  many  similar 
chau"acteristics . 

The  tradition  of  medical  confidentiality — the  doctor-patient  bond — is  a  common 

Hippocratic  heritage  expressed  in  the  ethical  codes  and  legal  systems  of  each  Western 

nation.     In  addition,  all  the  democracies  have  had  concerned  public  debates  during 

the  past  decade  over  the  impact  of  advanced  technology  on  privacy  ajid  citizen  rights, 

so  that  a  general  sensitivity  to  this  issue  has  become  part  of  the  political  culture 
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m  each  of  these  nations. 

Dissemination  of  computer  technology  has  also  been  a  multi-national  force.  The 
major  computer  manufacturers  and  developers  of  software  systems  operate  throughout 
the  industrial  nations,  spreading  machines,  systems  concepts,  and  tales  of  successes 
and  failures  as  part  of  their  marketing  endeavors.     In  addition,  international 
conferences  of  health  professionals  eind  medical  automation  specialists  exchange 
techniques  and  experiences  with  each  successive  generation  of  computer  systems. 
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As  we  examined  computer  development  abroad,  we  found  the  same  pattern  of  leading- 
edge  systems,  mainstream  users,  and  low-level  users  as  in  the  United  States.  Both 
from  our  observations  and  the  commentaries  of  technical  and  medical  experts,  it  was 
clear  that  no  country  as  yet  has  a  single  computerized  data  system  integrated 
throughout  its  national  health  care  programs.     Most  leading-edge  applications  are 
within  single  hospitals,  or  in  local  (regional)  health-service  delivery  areas,  or  in 
their  regional  or  national  health-payment  plans.    Even  these  applications  are  usually 
described  by  their  developers  as  still  "experimental;"  none  have  yet  filtered  down 
to  common  practice  in  the  clinics,  hospitals,  health  plans,  or  government  health 
services  of  any  country. 

Leading-edge  applications  in  most  European  nations  do  begin  with  a  greater  role 
for  national  or  regional  government  than  is  true  in  the  U.S.,  either  through  a 
socialized  medical  system  or  a  national  health  plan.     This  puts  most  other  democratic 
governments  in  a  more  direct  role  vis-a-vis  the  funding  and  evaluation  of  computer 
applications  in  health  care.     In  addition,  government  agencies  are  often  the  direct 
managers  of  regional  health  data  systems  that  maintain  a  record  about  the  health  of 
each  resident  in  a  city,  county,  or  similar  unit.     Here  the  availability  of  official 
citizen  identification  numbers  has  played  a  major  role. 

Within  hospitals,  either  as  single  institutions  or  as  cooperating  members  of  a 

consortium  sharing  a  common  computer  system,  the  pattern  of  applications  being 

pursued  in  Europe  peirallels  closely  what  we  have  described  in  American  hospitals. 

A  few  hospitals  are  pursuing  unified  hospital  information  systems,  and  report 

themselves  in  much  the  same  modular ly-developing  situations  as  Kaiser-Permanente , 

Massachusetts  General,  or  the  Texas  Institute  for  Research  and  Rehabilitation.  Other 

leading  hospitals  are  pursuing  discreet  applications,  such  as  automated  multiphasic 

health  testing,  problem-oriented  patient  records,  cardiac  display,  nursing  station 
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systems,  and  the  like.      The  great  majority  of  computers  in  health  care  in  all  these 
nations  is  still  devoted  to  accounting  systems  and  administrative  reporting. 

With  this  brief  overview  we  will  turn  to  a  discussion  of  how  medical  automation 
and  citizen  rights  activities  are  developing  in  six  democratic  nations:  Britain, 
Canada,  West  Germany,  Australia,  France,  amd  Sweden. 

Great  Britain 

The  National  Health  Service  (NHS)  provides  universal,  comprehensive  medical  care 

for  all  residents  of  Great  Britain.     The  patient's  point  of  entry  into  the  system  is 

the  family  physician,  a  general  practitioner  whose  government  remuneration  combines 

a  basic  practice  allowance,  fees  for  specific  items  such  as  maternity  service,  and 

capitation  fees.    Approximately  98    percent  of  the  population  is  registered  with  a 
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National  Health  Service  doctor.-^    A  few  private  health  insurajice  programs  have  been 

retained  and  are  generally  used  to  obtain  the  services  of  consultants  or  benefits 

It 

such  as  a  private  bed  in  a  public  hospital. 

The  1972  NHS  expenditure  (12,832)  represented  5.O6  percent  of  Britain's  GNP.^ 
Over  85  percent  is  financed  through  general  taxation.    A  little  less  than  ten  percent 
of  the  balance  comes  from  workers'  and  employers'  National  Insurance  contributions, 
with  the  remaining  amount  coming  from  services  requiring  cost-sharing,  such  as  dental 
treatment  and  charges  for  private  beds  in  public  hospitals.^ 
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The  Department  of  Health  and  Social  Security  is  responsible  for  the 
administration  of  NHS,  which  was  extensively  reorganized  in  197^.     Currently  the 
basic  unit  is  the  District.     It  supplies  250,000  persons  with  community  health 
services,  supported  by  the  specialist  services  of  a  district  general  hospital.  The 
Area  Health  Authority  is  the  primary  level  of  statutory  authority  with  planning  and 
operational  responsibilities.     Fifteen  Regional  Health  Authorities,  under  national 
policy  guidance,  allocate  resources  to  the  Area  Authorities. 

NHS  physicians  may  practice  alone  or  in  a  group,  and  over  half  the  family 
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doctors  are  members  of  partnerships.      In  1972  there  were  5^f500  physicians  in  Great 
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Britain,  a  ratio  of  one  per  1,000  population.^    About  half  the  general  practitioners 

see  private  (non-NHS)  patients,   but  only  five  percent  have  more  than  100  such 

patients . ■'■'^    The  number  of  hospital  beds  in  1971  was  508,000,  a  ratio  of  9.4  beds  per 

1,000  population.        During  the  I962-I97I  period,  in-patient  cases  increased  by  I9.7 

percent,  but  the  average  time  spent  in  hospitals  by  in-patients  fell  from  33.^6  days 
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to  23.87,  a  29  percent  reduction.        New  out-patients  rose  by  9.I  percent.  The 

proportion  of  private  beds  in  hospitals  is  one  percent,  and  the  number  of  private 
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patients  treated  is  usually  just  under  two  percent. 

Enthusiastic  predictions  in  the  middle  1960's  about  the  extent  to  which 

computers  could  be  utilized  within  the  British  health  care  system  have  been  tempered 

with  time  and  the  complexities  of  experience.     While  the  British  remain  active  in 

their  search  for  computer  applications,  the  Department  of  Health  and  Social  Security 

has  recently  instituted  an  evaluation  program  for  potential  applications  based  on  a 
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three-step  process  of  experiment,  development,  and  implementation.        Though  this 
cautious  approach  has  become  the  norm,  most  observers  note  that  the  place  of  the 
computer  in  the  delivery  of  health  care  is  secure.    As  one  expert  recently  stated, 
"In  contrast  with  the  situation  a  decade  ago,  when  a  computer  might  be  considered  an 
optional  extra  within  the  Health  Service,  computers  today  play  a  vital  role  in  many 
Health  Service  activities  and  their  future  potential  appears  virtually  limitless." 

There  are  three  principal  types  of  medical  computing  activities  in  Great  Britain: 
(1)  large  batch  processing  installations  concerned  with  routine  finance  and  national 
information  systems;   (2)  small  installations  usually  dedicated  to  single  applications 
and  associated  directly  with  medical  science,  pathology,  radiotherapy,  etc.;  and 
(3)  hospital -based  information  systems  that  would  be  considered  "leading  edge" 

systems. ■'■^    Among  the  applications  in  the  second  category  are  a  computer-based  drug 
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information  system,      automatic  discharge  summary  systems,        and  a  computer  assisted 
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system  for  the  management  of  hospital  waiting  lists.  ^ 

Probably  the  best-known  leading-edge  system  is  the  London  Hospital  Project.  The 

London  Hospital  is  a  multi-facility  acute  general  hospital  that  serves  a  large  local 

population  in  the  East  End  of  London;  it  is  also  a  highly  respected  teaching 
20 

institution.        The  project  was  launched  in  April  I968,  ajid  by  early  I972  the  first 
application  was  ready  to  begin,  using  Univac  equipment. 

The  first  application  implemented  was  the  waiting  list,  followed  by  admission 
smd  discharge  procedures.     A  patient  index  now  covers  30,000  records  and  there  is 
a  facility  for  seairching  the  index  with  a  minimum  of  identifying  data.    Additions  to 
the  admissions/discharge  procedures  include  a  survey  of  empty  beds.     "The  principal 
services  that  have  been  added,  however,  are  those  concerned  with  requesting 
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laboratory  tests — micro-biology  was  the  first,  followed  by  haematology,  bacteriology 
21 

and  biochemistry." 

Currently  under  development  is  an  extension  of  the  Patient  Index  to  cover  all 
new  outpatients,  X-ray  requesting  and  reporting,  nursing  manpower  reporting,  and  a 
number  of  minor  applications.     These  developments  require  further  extension  of  the 
communications  hardware  into  new  departments  of  the  hospital  and  an  increase  in  the 
number  of  visual  display  units,  printers,  and  lines  from  the  computer  room  throughout 
the  hospital. 

In  May  1970,  the  Government  appointed  a  Committee  on  Privacy  headed  by  the  Rt. 
Hon.  Kenneth  Younger  to  consider  whether  legislation  was  necessairy  to  provide  Britons 
with  protection  from  invasions  of  privacy  arising  from  activities  of  private  persons 
and  organizations.   (The  Younger  Committee  was  not  given  authority  to  investigate 
government  invasions  of  privacy.     That  was  to  be  handled  through  an  "in-house" 
inquiry  by  the  Government  itself,  under  the  Home  Office.) 

In  the  area  of  medical  privacy,  the  Younger  Committee  considered  problems  raised 
by  epidemiological  research,   (such  as  the  terms  under  which  it  is  permissible  for 
medical  research  workers  to  gain  access  to  medical  data  without  the  patient's  explicit 

consent)  and  privacy  issues  created  when  individuals  were  treated  by  physicians 

22 

hired  by  their  employers.        On  the  basis  of  a  national  opinion  survey,  the  Committee 
concluded  that  the  British  public  is  not  extremely  concerned  with  violations  of 
medical  privacy  and  that  the  principal  dangers  stem  from  the  increased  access  to 
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medical  information  by  non-medical  personnel — such  as  social  workers  and  researchers. 

According  to  the  Department  of  Health  and  Social  Security,  the  existing  status 
of  confidentiality  for  medical  records  can  be  summarized  as  follows:      "The  basic 
principle  applied  in  England  to  all  information  obtained  or  compiled  about  patients 
for  the  purposes  of  health  care  is  that  it  will  not  be  used  for  any  purpose  other  than 
that  for  which  it  was  supplied  or  obtained  without  the  consent  of  the  doctor  or 
dentist  concerned  and,  usually,  of  the  patient.     This  applies  both  to  personal  details 
provided  by  the  patient  himself...  and  to  information  compiled    by  doctors  sind  others 
relating  to  the  patient's  health. ...  Confidentiality  is  safe-guarded  both  by  the 
ethics  of  the  medical  profession  and  of  those  other  professions  which  contribute  to 
health  care. 

"It  is  for  the  doctor  or  dentist  concerned  to  decide  initially  whether  information 

about  his  patient,  provided  or  obtained  in  confidence,  should  be  disclosed 

voluntarily  outside  the  health  care  team;  to  a  relative  or  a  patient,  to  the  patient 

himself,  or  to  any  other  person  or  agency.     Medical  ethics  would  usually  require  that 

the  consent  of  the  patient  should  be  obtained  to  such  a  disclosure,  but  the  doctor 

or  dentist  concerned  would  decide  whether,  in  a  particular  case,  disclosure  without 

the  express  consent  of  the  patient  was  ethically  acceptable ... .A  patient  has  no 

right  of  access  to  his  own  personal  health  records,  or  to  any  information  contained 

therein.     It  is  at  the  discretion  of  the  doctor  or  dentist  concerned  to  disclose  to 

his  patient  such  clinical  information  as  he  considers  necessary  and  advisable  in  the 
24. 

Circumstances  ."^ 
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The  code  of  medical  ethics  of  the  British  Medical  Association  states  that  the 

"responsibility  of  a  doctor  for  the  safe  custody  of  his  confidential  records  is 

2  S 

the  same  whether  the  records  are  conventional  or  kept  in  a  computer."  ^    A  I969 

report  issued  by  a  BWA  V/orking  Party  on  Computers  in  Medicine  discusses  the 

complexities  added  to  the  confidentiality  issue  by  the  computerization  of  health  data 

and  notes  the  need  for  appropriate  procedures  to  protect  the  validity  and 
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confidentiality  of  the  information. 

General  concern  has  been  expressed  in  Great  Britain  regarding  the  growing  field 

of  medical  record  linkage.     Several  groups  of  doctors  protested  against  the 

establishment  of  a  central  databank  for  the  Oxford  Record  Linkage  Study  on  the 

grounds  that  existing  laws  and  procedures  do  not  afford  the  records  sufficient 

protection  (e.g.,  the  records  are  not  immune  to  subpoena)  and  that  these  records 

could  be  linked  with  social  service  and  criminal  records  to  create  general  dossiers 

on  persons  under  government  inquiry.     Similar  objections  were  made  to  the 

establishment  of  the  Mental  Health  Enquiry,  a  national  psychiatric  file.     Both  of 
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these  activities  proceeded  with  their  work,  however. 

In  the  courts,  questions  frequently  arise  concerning  the  release  of  medical  data, 
usually  in  connection  with  a  legal  proceeding.     In  these  cases,  the  courts  generally 

allow  the  information  to  be  given  only  to  the  concerned  party's  medical  advisor,  not 
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to  the  individual  or  his  or  her  legal  representative.        Another  recent  decision 

requires  doctors  to  give  police  officers    information  about  a  patient  which  may  lead 
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to  the  identification  of  a  driver  alleged  to  be  guilty  of  a  motoring  offence. 

In  December  1975 »  a  White  Paper  issued  by  the  Government  proposed  legislation 

to  establish  a  statutory  Data  Protection  Authority  with  powers  to  ensure  that 

computers  are  used  with  a  proper  regard  for  privacy  and  with  safeguards  for  the 

personal  information  they  contain.     The  White  Paper  states  that  the  existence  ajid 

purpose  of  information  systems  holding  personal  data  in  computers  should  be  publicly 

known,  as  should  the  categories  of  data  they  handle,  what  they  do  with  the  data,  and 

who  is  likely  to  have  access  to  it.     The  information  should  not  be  used  for  a 

purpose  other  than  the  one  for  which  it  was  given  or  obtained  without  either  the 

consent  of  the  person  whom  it  concerns,  or  some  other  authorized  justification.  The 

subject  should  be  able  to  discover  what  has  been  done  with  the  data  and  to  whom  it 

was  given,  and  information  should  be  kept  only  for  as  long  as  it  is  needed.  A 

temporary  Data  Protection  Authority  was  appointed  to  work  on  the  problem  during  the 
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time  period  prior  to  the  enactment  of  the  national  legislation.-^ 
Canada 

Primary  responsibility  for  health  care  in  Canada  is  vested  in  the  provinces, 
under  the  administration  of  a  provincial  Department  of  Public  Health.     Health  care 
services  are  provided  through  provincial  health  insurance  programs  which  cover 
approximately  99  percent  of  the  population.     The  federal  government  supplies  half 
the  funding  for  these  programs,  while  the  provinces  finance  their  portion  half 
through  general  tax  revenues  and  half  through  monthly  premiums  paid  by  families 
according  to  their  income  level. Private  insurance  companies  offer  supplementary 
coverage  for  items  not  included  in  the  government  plans,  such  as  private  beds  emd 
the  ten  percent  surcharge  that  physicians  sometimes  add. 
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Estimates  of  the  proportion  of  the  Canadian  GNP  devoted  to  health  services  vary 
from  four  percent^^  to  over  seven  percent. ^-^    In  1971  there  were  32,625  physicians  in 
the  country,  a  ratio  of  one  to  661  persons.     Nurses  numbered  114,303,  a  I/I86  ratio 
and  there  were  7,664  dentists,  a  ratio  of  1/2814.  Canadiaji  physiciajis  are  paid  on 

a  "fee  for  service"  basis,  with  reimbursement  fairly  automatic. 

The  types  of  automated  medical  information  systems  and  computer  applications  in 
medicine  in  Canada  cover  a  broad  spectrum.     One  sophisticated  system  is  the  D/laritime 
Ambulatory  Record  System,  a  federally  funded  health  research  project  in  the  Maritime 
Provinces  whose  prime  objective  is  the  development  and  implementation  of  a  quality 
care  ambulatory  health  record  system,  and  the  introduction  of  the  system,  where 
appropriate,  into  private  doctors'  offices. 

At  present  the  Project  is  using  a  CRT  terminal  to  abstract  information  from  the 

patient's  record  and  place  it  in  a  computer  file,  using  a  Control  Data  Corporation 

(CDC)  computer.     Some  outputs  that  are  possible  with  this  system  are  individual 

health  profiles,  family  profiles,  practice  profiles,  immunization  status  report  ajid 

automatic  recall,  peer  review,  and  a  variety  of  family  medicine  research  projects. 

Several  factors  which  facilitate  the  implementation  of  such  a  computerized  system  in 

this  location  are  that  every  resident  of  the  provinces  is  registered  with  an  insurance 

number,  providing  a  standard  life-long  identification;  that  Medical  Services 

Incorporated,  the  third  party  insurer,  maintains  a  population  file  listing  medical 

encounters  for  accounting  purposes;  and  that  the  region  is  geographically  small  and 
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discrete,  with  a  population  of  stable  and  manageable  proportions. 

The  Department  of  National  Health  and  Welfare  is  planning  a  computerized  health 
record  system  for  the  35,000  people  in  the  Northwest  Territories,  which  will  give 
district  health  offices  access  to  aji  Ottawa  service  bureau  through  telecommunication 

links.     The  system  would  contain  information  on  individual  health,  doctors,  facilities, 
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and  social  problems  such  as  alcoholism  and  drug  addiction. 

Other  types  of  computer  applications  in  Canadian  health  care  delivery  include 

clinical  laboratory  systems,  which  have  proved  to  be  cost-effective  for  high-volume 

laboratories;  a  few  patient  scheduling  projects;  automated  electrocardiogram 
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analysis;  multiphasic  screening;  and  medical  auditing.-^'     At  MacMaster  University, 
electronic  data  processing  is  used  for  an  epidemiological  analysis  of  patients 
attending  the  family  practice  unit,  and  registries  have  been  developed  for  cancer, 
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dialysis  equipment,  and  patients  with  severe  kidney  disorders. 

The  Science  Council  of  Canada  recently  issued  a  report  recommending  the 
development  of  regional  computerized  health  information  systems  covering  all 
Canadian  citizens,  v/ith  the  information  available  to  doctors  and  medical  researchers 
throughout  the  country.     The  report  found  the  use  of  computer-based  information 
processing  in  health  care  systems  desirable  as  well  as  inevitable,  and  urged  the 
development  of  health  information  systems  as  an  essential  tool  in  solving  operational 
and  research  problems  of  Canadian  health  care.-^^ 

The  earliest  legislative  activity  reflecting  a  concern  for  privacy  protection 
in  Canada  came  at  the  Provincial  level.     In  I968, British  Columbia  passed  a  Privacy 
Act  using  broad  language  to  prohibit  violations  of  privacy  that  are  willful  and 
"without  claim  of  right."    Manitoba  passed  similar  legislation  in  1970,  and  other 
provinces  have  concentrated  on  specific  areas  of  protection,  such  as  consumer  credit 
investigation  and  reporting. 
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At  the  Federal  level,  the  Departments  of  Communications  and  Justice  commissioned 
an  extensive  study  on  the  subject  of  computers  and  privacy  early  in  1971.  This 
report,  issued  in  1973 »  noted  the  absence  of  legislation  assuring  the  privacy  of 
health  data,  and  pointed  out  the  special  problems  raised  in  Canada  by  the  fact  that 
significant  amounts  of  computerized  data  are  actually  physically  located  in  the 
United  States.     In  the  medical  field,  this  includes  information,  collected  for 
utilization  review,  such  as  Canadian  hospitals  participating  in  the  PAS  data  system. 

The  study  found  a  considerable  exchange  of  health  information  among  government 
and  private  agencies.     The  response  to  one  questionnaire  indicated  that  78  percent 
of  responding  law  enforcement  agencies,  91  percent  of  the  insuremce  agencies,  59 
percent  of  oil  compsmies,  and  70  percent  of  the  major  industrial  employers  obtain 
information  about  individuals  from  "medical  sources"  at  least  some  of  the  time. 

In  regard  to  computerized  information  systems  in  general,  the  report  commented 
on  the  need  for  regulation  of  databanks  that  contain  sensitive  information  about 
identifiable  individuals,  with  particular  attention  to  accuracy,  relevance,  control 
over  distribution,  security  standsirds,  the  provision  of  opportunities  for  access,  and 
guidelines  for  collection  procedures.        The  report  also  concluded  that  the 
government,   "as  the  principal  collector  and  instigator  of  the  collection  of  personal 
information,  has  a  key  role  to  play,"  and  suggested  that  some  appropriate  responses 
might  be  the  establishment  of  a  surveillance  agency  and  an  ombudsman,  a  code  of 
ethics  governing  research  conducted  with  government  funds,  and  the  implementation  of 
administrative  rules  enforced  by  a  central  agency. 

Peter  Robinson,  deputy  chairman  of  the  computer-communications  secretariat  of 
the  Canadian  Federal  Communications  Department^  noted  that  the  creation  of  the  medical 
databank  suggested  by  the  Science  Council  would  require  the  use  of  a  Single  Identity 
Number  to  allow  doctors  and  resesirchers  to  coordinate  information  from  different 
sources.     He  criticized  the  Council's  report  for  ignoring  the  issue  of  privacy 
invasion  that  would  be  raised  by  adoption  of  such  a  number. 

As  in  the  United  States,  the  medical  record  in  Canada  is  considered  to  be 
legally  the  property  of  the  physician,  and  the  hospital  record  belongs  to  the 
hospital.        While  the  question  of  patient  access  to  records  is  a  looming  issue, 
privacy  and  confidentiality  problems  have  so  far  received  more  attention. 

A  proposed  piece  of  legislation  in  Canada,  the  Canadian  Human  Rights  Act,  is 

partially  devoted  to  the  protection  of  personal  information,  and  if  passed  would 

affect  government-held  medical  records.     The  Act  would  permit  the  Government  to 

issue  regulations  prescribing  the  conditions  under  which  third  parties  would  have 

access  to  identified  records,  when  individuals  would  be  notified  that  records  are 
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maintained  about  them,  and  under  what  circumstances  records  could  be  corrected.  ' 
The  bill  has  passed  only  its  first  reading,  with  the  remaining  two  readings  not 
expected  soon. 


Federal  Republic  of  Germany 

The  Federal  Republic  of  Germany  has  one  of  the  oldest  public  health  insurgmce 
programs  in  Europe,  dating  back  to  1883.     Presently  over  90  percent  of  the 
population  is  insured  through  statutory  programs.     Other  forms  of  protection,  such 
as  private  insurance,  bring  the  percentage  of  persons  covered  by  some  form  of  health 
insurance  to  98.6  percent. 

The  administration  of  the  system  is  decentralized,  with  1,800  local  health 
insurance  "funds"  serving  the  population.     There  are  three  general  categories  of 
persons  covered  by  the  statutory  program.     Those  compulsorily  insured  consist  of  all 
wage  earners,  salaried  employees  with  incomes  below  a  prescribed  ceiling,  aind  persons 
receiving  unemployment  benefits  or  assistaxice;  59?^  of  insured  persons  are  in  this 
group.     Age-old  pensioners  comprise  a  second  group,  and  account  for  26  percent  of 
the  insured  population.    Finally,  15  percent  are  voluntarily  insured,  and  consist  of 
self-employed  persons  with  incomes  below  the  ceiling,  salaried  employees  not 
formerly  insured,  new  entrants  into  employment  at  a  salary  above  the  limit  for 
compulsory  insurance,  and  various  groups  undergoing  occupational  training. ■^'^ 

Financing  of  the  health  insurance  plans  is  generally  through  contributions  from 
employers  and  employees,  with  the  fee  schedule  determined  by  income  levels.  Direct 
contributions  by  the  government  are  minimal,  although  there  are  several  indirect 
methods  of  government  assistance,  such  as  subsidies  to  the  compensation  funds  of 
small  companies  and  direct  allocations  to  health  providers .•^'^ 

Normally  doctors  are  remunerated  on  a  f ee-f or-service  basis.     The  physiciams 

report  the  services  rendered  to  the  local  practitioners'  association,  which  presents 
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the  claims  to  the  sickness  funds  and  distributes  the  payments  due.^ 

The  physician/population  ratio  in  West  Germany  Is  fairly  high,  better  than  one 
per  600  persons  in  1973.^-^    In  I965  there  were  l4.5  doctors  for  every  10,000  people, 
as  compared  to  11.?  in  Canada,  and  11.5  in  the  United  Kingdom. A  I969  estimate 
indicated  that  5.7  percent  of  the  German  GNP  was  expended  on  health  services. ^-^ 

There  were  3,601  hospitals  in  the  Federal  Republic  of  Germajiy  in  19^9 ,  with  an 
average  of  188.2  beds  per  hospital.     Public  hospitals  numbered  1,3^5!  private 
charitable  institutions  1,281 5  and  there  were  975  private  profit-making  hospitals. 
The  number  of  hospital  beds  per  10,000  population  in  I965  was  107;  in  Canada  it  was 
110,  in  the  United  Kingdom  105.5,  and  the  United  States  90.^' 

A  leading -edge  German  computer  system  is  the  Medical  System  Hannover  (MSH)  at 
the  Hannover  Medical  School  Hospital,  an  independent  medical  school  owned  and 
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operated  by  the  State  of  Lower  Saxony.        A  major  objective  of  the  project  is  to 

"provide  a  system  for  the  acquisition,  integration,  retrieval,  and  analysis  of 

information  about  hospital  patients  and  hospital  resources  in  order  to  support 
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patient  and  hospital  management,  and  to  provide  data  for  scientific  analysis. 

The  system  operates  a  central  databajik  with  files  on  both  magnetic  disc  and 
tape  storage.    A  Status  Summary  File  contains  information  for  all  patients  who  have 
ever  been  admitted,  and  the  system  keeps  condensed  relevant  information  on-line  as 
long  as  possible.    Every  Hannover  patient  is  given  a  unique  ten-digit  identification 
number,  assembled  from  the  birth  date,  birth  name,  sex,  and  a  running  counter. 
This  number  is  the  ordering  and  search  key  for  the  system.     Several  administrative 
functions  are  performed  by  the  MSH,  including  admissions  and  billing,  and  a 
pharmacy  system  is  under  development. 
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The  computerized  data  base  has  not  replaced  the  manual  chart;     that  is  used 
during  the  patient's  stay  and  then  microfilmed,  with  the  paper  record  destroyed  after 
the  patient's  discharge.     Although  the  computerized  system  does  not  yet  contain 
sufficient  data  to  be  comprehensive,  its  contents  is  growing  rapidly  and  Hannover  hopes 
to  extend  it  to  a  complete  record. 

Although  less  concern  for  the  problems  of  data  collection  and  privacy  has  been 
voiced  by  the  public  in  Germemy  than  in  some  other  industrialized  nations,  the  issue 
of  data  protection  did  become  more  prominent  in  the  late  1960's  with  the  institution 
of  computerized  population  registries  and  a  government  plan  to  introduce  a  uniform 
national  personal  identifier. 

Several  West  German  states  ( lender )  pioneered  in  creating  administrative 

protections  for  personal  data  in  computer  systems.     The  Data  Protection  Act  of  the 

State  of  Hesse,  passed  in  1970,  was  the  first  such  general  statute  enacted  in  a 

Western  nation.     The  Act  applies  to  all  public  automated  data  systems  under  the 

jurisdiction  of  the  State  of  Hesse,  and  its  objective  is  to  insure  that  data  shall  be 

obtained,  transmitted  and  stored  in  such  a  way  that  it  cannot  be  used,  altered,  or 

destroyed  by  unauthorized  persons.     Persons  responsible  for  the  preparation, 

transmission,  storage  or  automatic  processing  of  data  must  adhere  to  strict  standards 

of  confidentiality,  and  individuals  have  the  right  to  correct  inaccurate  data  about 
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themselves . 

A  significant  feature  of  the  Act  is  the  creation  of  an  Office  of  Data  Protection 
Commissioner.     This  person  functions  as  an  ombudsman  to  receive  complaints  from  the 
public  and  is  also  directed  to  insure  compliance  with  the  1970  act  and  other 

regulations  concerning  confidential  handling  of  personal  information.     The  Commissioner 
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can  also  set  additional  measures  to  improve  data  protection. 

Other  West  German  states  have  since  passed  similsir  legislation.     There  have  also 
been  several  attempts  to  enact  a  Federal  law,  the  most  recent  draft  of  which  is  a 
currently  pending  Data  Protection  Act  introduced  by  the  Ministry  of  the  Interior. 
This  bill  would  cover  both  mamual  and  automated  data  systems,  in  the  public  and 
private  sectors.     However,  different  regulations  would  be  applied  to  public  databanks, 
data  processing  by  private  organizations  for  internal  purposes,  and  data  processing 
done  for  third  parties  by  private  agencies  on  a  professional  basis,  such  as  credit 
agencies  and  publishers  of  mailing  lists. 

The  rules  for  the  first  two  categories  are  quite  general,  with  no  provision  for 
an  independent  supervisory  institution  that  could  maike  the  broad  provisions  of  the . 
Act  more  specific  and  supervise  administrative  compliance.     Only  in  the  last  category  - 
service  bureau  operations  -  is  there  a  provision  for  outside  control,  but  this  is 
through  supervisors  at  the  state  rather,  than  federal  level.     One  important  requirement 
is  that  an  individual  be  notified  the  first  time  data  concerning  him  or  her  is 
communicated .  ^-^ 

As  in  most  Western  European  nations,  the  Federal  Republic  of  Germany  has  a 
broad  declaration  of  the  doctor's  duty  to  remain  silent  on  confidential  information 
concerning  a  patient,  (paragraph  300,  Deutsche  Strafgesetzbuch) .^^    There  is  no 
specific  legal  ban  on  the  use  of  medical  information  for  secondsiry  purposes. 
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Australia 

In  1975  Australia  passed  legislation  which  replaced  its  voluntary  health 
insurance  system  with  a  compulsory  tax-financed  system  known  as  Medibank. Before 
that,  about  78  percent  of  the  population  (a  1972  figure)  had  been  insured  for  medical 
benefits  and  80  percent  for  hospital  benefits.^^    Under  the  current  system,  medical 
services  continue  to  be  provided  predominantly  by  private  practitioners  on  a  fee-for- 
service  basis,  but  a  single  Governmental  Health  Insurance  Commission  now  provides 
reimbursements . 

Privacy  issues  have  received  increased  attention  in  Australia  in  the  past  few 
years.     The  Labor  Party  included  in  its  1973  national  platform  a  commitment  to  "the 
right  of  privacy."^'''    There  has  also  been  debate  recently  on  whether  Australia's 
accession  to  the  United  Nations  International  Covenant  on  Civil  and  Political  Rights 
(which  repudiates  "unlawful  interference  with. . .privacy"  and  establishes  the  right  to 

protection  of  law  against  such  interference)  will  raise  protection  of  privacy  in 
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Australia  from  a  State  to  a  Federal  issue,  as  a  matter  of  treaty  obligation. 

The  Jaycees  of  New  South  Wales  Issued  a  widely  quoted  report  in  1968, 
"Invasion  of  Personal  Privacy,"  which  explored  sueii  issues  as  surveillance  suad  the 
credit  industry.     In  1975 i  the  State  of  New  South  Wales  established  a  Privacy 
Committee  to  research  and  develop  a  general  policy  towards  privacy.     It  is  to  receive, 
investigate  and  mediate  in  complaints  by  individuals  regarding  unjustifiable  invasions 
of  privacy;  to  disseminate  public  information  and  stimulate  public  debate  on  the 
issues}  and  to  recommend  law  reform  and  changes  in  administrative  and  business 
practice . 

Currently  the  only  laws  at  either  the  State  or  Federal  level  protecting  the 

confidentiality  of  medical  records  are  statutes  in  the  Evidence  Acts  of  the  States  of 

Victoria  and  Tasmania  prohibiting  physicians  from  testifying  about  patients  in  legal 
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proceedings  without  their  consent.        In  Victoria,  this  privilege  has  been  interpreted 
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by  the  courts  as  also  applying  to  the  provision  of  written  documents.' 

When  the  national  health  insurance  system  was  being  debated  in  1973-7^,  the 

problem  of  protecting  the  confidentiality  of  medical  records  became  the  target  of 

sharpened  concern.     The  Australiaji  Medical  Association  based  part  of  its  objection  to 

this  program  on  the  absence  of  privacy  safeguards  in  the  legislation.     In  1973 »  the 

Attorney  General  established  a  Committee  of  Enquiry  into  the  Protection  of  Privacy,  to 

recommend  legislation  to  protect  individual  privacy  under  the  proposed  health 
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insurance  arrangements. 

In  December  1973 »  the  Committee  issued  a  report  with  recommendations  concerning 
the  collection  and  retention  of  information  by  the  Health  Insurance  Commission,  the 
confidentiality  of  health  data,  individual  rights  of  access,  and  the  security  of 
health  information  systems  under  Medibank.     However,  this  report  was  tabled  in  both 
houses  of  the  Australian  Parliament  in  197'^-.'^"^    Medibank  thus  went  into  effect  on 
July  1,  1975  without  statutory  safeguards  for  privacy. 

A  Bill  was  then  introduced  into  the  Federal  Parliament  to  amend  the  Health 
Insurance  Act  by  incorporating  provisions  to  protect  the  privacy  of  individuals,  as 
recommended  by  the  Committee.    Among  these  provisions  are  requirements  which  would 
restrict  access  to  medical  records  to  persons  requiring  such  access  for  operation  of 
the  program,  establish  a  record  of  every  access  to  a  record  that  is  not  a  routine 
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access  essential  to  daily  operation  of  the  Health  Information  Act,  allow  individuals 
access  to  their  ovm  records,  and  destroy  records  after  a  specified  time  period. 
The  Bill  would  also  require  persons  with  access  to  medical  records  to  protect  the 
confidentiality  of  the  data  and  require  the  issuance  of  a  warrant  in  order  for  police 
to  have  access  to  medical  records. 

Due  to  the  dissolution  of  the  Australian  Parliament  in  November  1975 »  the  Bill 
lapsed.     However,  the  new  government  is  expected  to  introduce  similaur  legislation  at 
the  1976  parliamentary  session. 

Currently,  Medibank  patients  are  identified  by  a  unique  numbering  system; 
although  the  number  is  based  on  personal  details,  such  as  birthdate,  it  is  coded  so 
that  this  information  cannot  be  determined  from  the  number.     It  is  not  necessary  to 
produce  a  Medibank  card  or  to  quote  a  Medibaink  number  to  obtain  medical  services,  if 
identity  can  be  proved  by  other  means.     It  is  also  possible  to  claim  Medibank  benefits 
without  quoting  the  Medibank  number  if  the  required  personal  details  are  given. 

Patients*  claims  histories  are  automated,  with  access  by  meams  of  the  Medibank 
number  only.     History  printouts  contain  number  but  not  name.     Requests  for  printouts 
are  monitored  by  a  security  officer  in  each  processing  center,  who  ensures  their 
destruction  after  use.     Documents  and  microfilm  copies  of  documents  are  not  held  in 
claimant  or  patient  files,  but  are  filed  in  order  of  processing  which  makes 
unauthorized  access  difficult. ' 

One  other  event  which  stimulated  discussion  about  privacy  of  medical  records 
was  a  Seminar  on  Medical  Records  Systems  in  Primary  Health  Care,  held  in  Canberra  in 
April  197^  by  the  Hospitals  and  Health  Services  Commission  and  the  Royal  Australian 
College  of  General  Practitioners.     The  recommendations  which  resulted  from  this 
Seminar  emphasized  the  need  for  detailed,  integrated  health  records  and  the  importance 
of  protecting  the  patient's  privacy  while  meeting  the  needs  of  practitioners, 
administrators,  and  researchers. 


France 

Over  99  percent  of  the  French  population  is  covered  by  compulsory  health 

insurance,  either  through  the  general  national  plan  or  special  plans  for  groups  such 

as  miners,  agricultural  workers,  seamen,  civil  servants  and  railway  employees. 

However,  coverage  under  these  programs  is  not  complete,  so  that  additional  insurance 

77 

and  private  incomes  also  finance  a  significant  proportion  of  French  health  care.'' 

Most  of  the  industrial  work  force  is  covered  by  the  general  scheme  administered 

by  the  National  Sickness  Insurance  Fund,  which  is  directly  supervised  by  the 

Ministry  of  Public  Health  and  Social  Security  and  the  Ministry  of  Finance.     The  Fund 

in  turn  supervises  16  Regional  and  121  Primary  Sickness  Insurance  Funds.  Local 

branches  of  the  sickness  funds  are  financed  from  the  central  general  fund  and  are 

the  agencies  which  provide  cash  refunds  to  individual  health  care  customers . "^^ 

Many  benefits  cover  only  part  of  the  cost  of  medical  care  in  France;  for  example, 

the  insurance  fund  usually  repays  the  patient  for  medical  expenses  at  the  rate  of 

75  percent  of  the  cost  based  on  the  current  scale  of  fees  in  the  locality  where  the 

nearest  doctor  to  the  insured's  home  resides.     As  a  consequence,  61. k  percent  of  the 
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French  population  belong  to  mutual  societies  to  augment  their  coverage.'^ 
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The  Benefits  system  administered  by  the  National  Sickness  Insurance  Fund  is 

financed  by  contributions  made  by  the  employer  and  employees.     Contributions  are 
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based  primarily  on  earnings,  with  the  employer  bearing  most  of  the  costs. 

In  1971,  approximately  5.5  percent  of  the  French  GNP  was  spent  on  medical  care. 

The  ratio  of  physicians  in  the  population  as  of  I968  was  12.8  per  10,000,  with  great 

regional  variation.     Similarly,  there  were  214  nurses  and  518  hospital  beds  per 

10,000  population.     The  total  number  of  doctors  in  France  in  1972  was  68,778,  a  ratio 

of  1.335  per  1,000  population.     Of  these,  almost  50,000  were  treating  private  patients 
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during  at  least  part  of  their  working  year. 

For  many  years,  any  protection  of  privacy  under  French  law  rested  on  the 
generalized  command  of  Article  1382  of  the  Civil  Code  of  1804.     This  states,   "Any  act 
which  causes  injury  to  another  renders  the  person  responsible  for  the  act  legally 
bound  to  repair  the  injury."    Specific  provisions  added  to  this  law  over  the  years 
dealt  mostly  with  the  duties  of  lawyers,  physicians,  public  officials  and  other 
similar  persons  to  preserve  the  confidentiality  of  personal  information  revealed  to 
them  in  the  course  of  their  occupations. 

A  new  provision  dealing  expressly  with  privacy  was  inserted  into  the  Civil  Code 

in  1970.     It  provides:  "Everyone  has  the  right  to  have  his  private  life  respected. 

Judges  have  the  power. ..to  prescribe  all  measures .. .which  may  be  necessary  to  prevent 

or  stop  an  intrusion  on  or  into  the  intimacy  of  private  life...."    This  statute  is 

far  less  powerful  in  practice  than  it  seems  on  its  face,  however,  because  it  is 

difficult  to  define  in  a  particular  case  whether  an  action  does  constitute  such  an 
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intrusion. 

Currently,  the  legal  basis  of  medical  secrecy  is  found  in  Article  378  of  the 
Penal  Code,  which  states:  "Physicians,  surgeons  and  other  health  officers,  together 
with  pharmacists,  midwives,  and  all  others  who  by  reason  of  profession. . .are  entrusted 
with  secrets  confided  to  them,  except  where  obliged  or  authorized  by  law  to  give 
testimony,  having  revealed  these  secrets,  shall  be  punished  by  imprisonment  of  from 
one  to  six  months  and  to  a  fine  of  500  to  3»000  francs. 

This  rule  of  secrecy  is  not  absolute,  as  the  patient  may  lift  it.     Physicians  are 

also  obligated  to  report  certain  medical  facts  to  public  services,  e.g.,  contagious 

and  occupational  diseases,  and  medical  records  may  be  required  for  a  legal  proceeding. 

Another  factor  complicating  rules  of  medical  secrecy  and  access  in  France  is  that, 

according  to  1970  and  1972  decisions  by  the  French  Supreme  Court  and  Council  of  State, 

the  files  in  a  medical  center  belong  to  the  center  itself  and  not  to  the  physicians 

who  assembled  themj  therefore  only  the  doctors  currently  in  practice  at  the  center  may 
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see  them,  and  the  originating  physicians  may  not. 

In  1974,  there  was  considerable  furor  in  France  over  reports  that  a  government 
project,  code-named  "Safari,"  was  under  way  to  give  every  person  in  France  a  single 
identification  code,  in  order  to  facilitate  the  quick  retrieval  of  information  stored 
by  different  data  systems.     As  a  result  of  public  outcry,  the  Government  appointed 
the  Commission  Informatique  et  Libertes  (Commission  on  Automation  and  Liberty).  The 
Commission,  headed  by  Bernard  Chenot,  vice  president  of  the  Council  of  State,  held 
extensive  hearings  amd  did  studies  of  the  databajiks  and  privacy  issue  in  the  main 
sectors  of  record-keeping  about  French  citizens. 
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Its  report,  issued  in  September,  1975i  notes  the  clangers  in  the  growth  of  data 
systems,  both  manual  and  automated,  and  points  out  that  even  without  a  single 
identifier  it  is  possible  to  match  files  through  common  elements.     The  report  suggests 
that  individuals  need  to  check  the  veracity  of  data  in  files  concerning  them  and  that 
they  should  be  able  to  correct  errors  and  fill  gaps.     The  report  also  recommends  the 
creation  of  a  standing  committee  on  data  systems  and  liberty  "responsible  for 
supervising  the  negative  and  positive  regulations  pertaining  to  data  processing."  ' 

A  Health  Committee  of  the  Chenot  Commission  submitted  a  background  Report  on 
Medical  Files  to  the  main  Commission,  after  studying  files  containing  medical 
information  maintained  by  all  orgainizations  coming  under  the  jurisdiction  of  the 
Ministry  of  Health.     These  files  fall  into  three  categories:     1)  Hospital  Logistics 
files — 28  systems  which  are  essentially  administrative,  with  only  minor  content  of 
medical  information}  2)  Medical  Methodology  Systems — 258  systems  which  process  medical 
information  with  the  goal  of  improved  therapeutics,  or  sinalyze  data  from  emalytical 
or  diagnostic  equipment,  or  do  epidemiological  statistics;  and  3)  Medical  Dossiers — 
81  systems  usually  used  for  processing  partial  medical  records  associated  with  one 
disease  treated  by  a  particular  hospital. 

In  terms  of  their  potential  risks  to  individual  rights,  the  Health  Committee 
found  that  those  in  the  first  category,  although  primarily  administrative,  still 
contain  sensitive  personal  information  and  need  protection.     The  second  type, 
automated  medical  systems,  are  mainly  impersonal,  but  could  be  sensitive  in  an 
interconnected  network  of  systems.     The  medical  dossiers  always  contain  personal 
medical  histories,  and  are  therefore  always  susceptible  to  rights  violations. 

The  main  report  offered  a  series  of  suggestions  to  cope  with  threats  to 
individual  rights  caused  by  data  systems,  including  several  related  specifically  to 
medical  records:     1)  the  creation  of  a  permanent  board  to  serve  as  a  source  of 
information,  advice,  and  advocacy  in  matters  concerning  automation  and  civil 
liberties;     2)  a  review  of  the  judicial  basis  of  medical  secrecy;  3)  the  binding  to 
secrecy  of  the  holder  of  a  medical  file;        publication  of  the  existence  of  medical 
file  systems  and  the  identity  of  the  persons  responsible;  5)  the  prohibition  of 
certain  uses  of  medical  files,  with  the  clear  indication  of  the  purpose  of  a  system 
at  the  time  of  installation;  6)  the  authorization  of  certain  files  only  after 
investigation  by  a  supervisory  authority;  7)  the  design  of  files  so  that  patients  are 
not  excluded  from  information  that  others  may  share;  and  8)  a  system  for  data 

verification  by  the  patient  or  by  an  independent  second  opinion  with  access  to  the 
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same  information  from  which  the  file  was  created.        These  proposals  are  now  before 
the  French  Parliament. 

Sweden 

All  resident  Swedish  citizens  are  covered  by  compulsory  health  insurance.  Prior 
to  1955,  voluntary  health  insurance  was  provided  by  a  network  of  registered  sickness 
funds;  since  I963,  a  comprehensive  national  insurance  program  has  been  in  effect. 
This  system  is  administered  by  26  regional  insurance  offices;  these  are  regarded  as 
independent  but  operate  under  the  central  supervision  of  the  National  Social 
Insurance  Board.     This  Board  is  responsible  to  the  Minister  of  Health  and  Social 
Affairs. 
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Swedish  residents  may  enter  the  state  health  system  through  any  one  of  three 
avenues:   hospital  out-patient  departments,  which  account  for  half  of  all  ambulatory 
consultations  ;  district  medical  officers,  who  account  for  25  percent  of  ambulatory 
care;  and  private  practitioners,  in  which  case  the  patient  pays  the  doctor's  fee  and 
is  reimbursed  by  the  insurance  office  for  75  percent  of  the  appropriate  amount  on  a 
sickness -insurance  tariff  fixed  by  the  Government.     Hospitalization  is  free  to  the 
patient. 90 

Financing  of  this  system  is  also  tripartite.     The  State  subsidy  covers  55 

percent  of  all  medical  benefit  costs  other  than  drugs.     The  employee  contribution  is 

a  combination  of  flat  rate  and  percentage  of  income,  and  the  employer's  contribution 

is  a  percentage  of  payroll  earnings.  (Self-employed  persons  also  make  a  contribution.) 

Hospitals,  the  district  medical  officer  service,  and  supporting  local  health  services 
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are  provided  at  the  county  and  municipal  level  out  of  local  taxation. 

The  number  of  active  medical  practitioners  in  Sweden  in  1970  was  10,500,  or  one 

per  760  population.     Hospital  physiciajis  form  the  large  majority  of  doctors;  they  are 

salaried,  as  are  district  medical  officers.     More  than  3fOOO  doctors  are  engaged  in 

private  practice,  either  totally  or  in  off-duty  periods.     At  the  end  of  1970,  there 

were  130,000  hospital  beds  in  Sweden,  a  ratio  approaching  17  per  thousajid  population. 

All  beds  in  public  hospitals  are  public;  unlike  several  other  European  countries,  it 

is  not  possible  to  pay  extra  for  more  private  facilities  in  such  hospitals.  While 

there  is  little  private  health  insurance  in  Sweden  for  medical  costs,  there  is 
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insurance  to  provide  cash  income  during  illness.^      In  1971 »  8  percent  of  the  Swedish 
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GNP  was  devoted  to  health  caxe . 

Sweden  is  the  site  of  several  advanced  medical  information  systems.     One  of  these 
is  the  Stockholm  County  Medical  Information  System,  at  Dajideryd  Hospital.     This  is 
administered  by  the  Stockholm  County  Medical  Service  Board,  which  serves  a  population 
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of  1.5  million  persons  and  has  under  its  jurisdiction  71  hospitals  with  20,700  beds.^ 
When  the  Stockholm  County  Council  decided  to  implement  this  system  in  I967,  its 
requirements  were  that  the  system  1)  cover  the  entire  county?  2)  be  "real  time;" 
3)  be  modular ly  designed  so  functional  routines  could  be  added  progressively;  and 
k)  cover  routine  administrative  as  well  as  medical  cind  planning  f unctions. 

Since  each  Swedish  citizen  is  assigned  at  birth  a  ten-digit  identification  number, 
containing  his  or  her  birth  date,  this  number  was  chosen  as  the  patient  identification 
number  for  the  system.     This  made  it  easy  to  obtain  initial  personal  identification 
information  for  the  system  from  census  and  tax  files.    A  Univac  computer  was 
installed  at  Danderyd  in  I968  and  a  second  one  was  added  in  1971.     The  system  is 
designed  to  handle  the  flow  of  information  between  individual  physicians,  medical 
departments,  and  hospitals  throughout  the  region. 

There  are  three  primary  files  in  the  system.     The  Main  File  (on-line)  contains 
medical  information  on  all  in-patient  visits  and  X-ray  examinations  performed  in  the 
county  since  the  beginning  of  I968.     The  file,  comprised  of  relevant  data  on  all 
"presumptive  patients,"  meaning  all  inhabitants  of  the  county,  includes  Census 
inf omnation,  critical  medical  information,  information  on  previous  in-patient  care, 
and  information  on  previous  X-ray  examinations.     The  file  is  updated  weekly  from 
magnetic  tapes  from  the  Central  Population  Registry. 
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An  on-line  Patient  File  for  each  hospital  or  group  of  hospitals  contains 

information  on  current  patients.     This  data  is  stored  only  during  the  time  the  person 

is  actually  a  patient.     A  Medical  Records  File,  containing  all  information  from 

previous  and  current  treatment  periods,  is  presently  still  stored  manually.  Within 

two  years,  such  medical  records  will  be  stored  on  microfilm.     In  addition  to  these 

main  patient  files,  there  are  Health  Controls  and  Home  Care  Files  which  contain 

information  on  examinations  and  tests  to  be  performed,  on  results  of  tests  and 

analysis,  and  on  ordered  therapies.     A  Statistics  File  contains  selected  information 
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from  the  patient  files  and  from  health  care  systems  and  is  processed  in  batch  mode.^ 
Among  the  functions  performed  by  this  system  are  information  retrieval  from  the 
main  population  file,  in-patient  registration,  resource  scheduling  and  booking,  out- 
patient registration,  laboratory  routines  and  waiting  list.     The  system  is  in 
operation  24  hours  a  day,  with  about  300  terminals  in  operation. 

In  1970,  when  the  Swedish  public  began  to  be  concerned  about  issues  of  privacy 
and  technology,  the  most  important  relevant  statute  was  the  national  Secrecy  Act. 
This  law  exempts  from  disclosure  to  the  public  and  the  press  certain  categories  of 
records,  such  as  those  dealing  with  foreign  affairs,  the  questions  and  results  of 
competitive  examinations,  and  depositions  and  evidence  in  court  cases  that  have  not 
yet  come  to  trial.     For  other  classes  of  records,  such  as  census  and  taix -return 
records,  the  Act  restricts  circulation  whenever  the  subject  of  the  record  has  not 
given  express  permission  for  its  further  use.     The  Act  also  provides  that  personal 

records  of  medical  care,  social  rehabilitation  aid,  financial  status,  family  affairs, 
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and  the  like,  should  not  be  revealed.^' 

With  the  publication  of  the  1970  census,  an    intense  and  unexpected  controversy 
over  privacy  arose  within  Sweden.     This  stemmed  from  growing  public  uneasiness  over 
computerizing  the  census  and  other  related  statistical  activities  that  used  personal 
identifiers.     The  two  main  points  raised  during  this  debate  were    1)  collecting  data 
about  people,   their  attitudes,  and  their  life-styles  could  give  the  authorities  a 
possibility  of  too  much  of  ccntrol  over  the  affairs  of  individuals;  and  2)  the 
expansion  of  automated  data  processing  seemed  to  presage  a  super-efficient,  unforgiving 
police  state,  very  different  from  the  customary  paternalistic  bureaucracy  to  which 
Swedes  were  accustomed. 

The  task  of  examining  the  effects  of  automatic  data  processing  on  traditional 
record-keeping  laws  and  practices  was  given  to  an  advisory  committee  in  the  Justice 
Department  that  was  already  at  work  on  the  broader  problem  of  recodifying  the  Freedom 
of  the  Press  Act.     During  1970  and  1971.  the  Committee  on  Public  Access  and  Secrecy 
surveyed  the  use  of  automatic  data  processing  in  both  the  public  eind  the  private 
sectors.     In  its  1972  report,  the  Committee  found  that  although  public  unrest  about 
wide-spread  intrusion  upon  personal  privacy  was  not  objectively  supported  by  the 
evidence,  the  growing  use  of  the  computer  in  gathering,  storing,  processing  and 
disseminating  information  about  people  was  introducing  sufficient  changes  in  the 
nature  and  power  of  administration  so  that  new  legal  measures  of  control  were  needed. 

The  Committee  presented  draft  legislation  designed  to  regulate  the  effects  of 
computerized  record  keeping  while  allowing  the  rationalization  that  automatic  data 
processing  is  capable  of  bringing  to  complex  administration. 
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The  Swedish  Data  Act  was  passed  substantially  as  drafted  and  became  law  on 
July  1,  1973,  to  take  effect  on  July  1,  197^. 

Under  the  Act,  every  business  or  government  agency  wishing  to  maintain  a 
computerized  file  of  information,  containing  data  which  can  be  identified  with  a 
particular  individual  must  first  obtain  the  permission  of  the  Data  Inspectorate,  a 
nine-member  public  body  appointed  by  the  King-in-Council.     The  Data  Inspectorate 
grsmts  permission  to  operate  a  personal  file  system  if  it  finds  there  is  no  reason 
to  expect  it  to  create  undue  risk  of  intrusion  into  the  privacy  of  the  persons 
registered.     No  licensed  system  may  store  medical  or  criminal-record  data  unless  it 
is  authorized  to  do  so  by  law  or  this  has  been  specifically  approved  by  the  Data 
Inspectorate . 

The  Act  defines  with  considerable  precision  the  duties  of  the  "responsible 
keeper"  of  each  registered  file.     He  is  liable  for  criminal  penalties  provided  for 
violation  of  the  Act.     The  responsible  keeper  must  furnish  amy  data  subject,  upon 
request,  with  a  complete  copy  of  all  information  about  him  or  her  contained  in  the 
file,  unless--as  with  certain  medical  and  criminal  data — that  is  expressly  prohibited. 
If  the  personal  data  are  found  to  be  incorrect,  the  keeper  is  obliged  to  have  them 
corrected;  if  incorrect  data  have  been  disseminated  by  the  system,  the  recipients 
must  be  notified  of  the  corrections. 

The  Data  Inspectorate,  in  addition  to  acting  as  a  national  licensing  body,  is 
also  responsible  for  supervising  and  inspecting  registered  systems,  as  well  as 
serving  an  ombudsman  (citizen  complaint)  function  for  all  government  data-processing 
activities . 

Because  the  Data  Law  of  1973  and  Swedish  automated  medical  record  systems 
developed  side  by  side,  an  equilibrium  was  established  from  the  early  1970 's  onward 
between  the  goals  of  the  medical  record  keepers  and  the  requirements  of  the  law. 
Therefore,  passage  of  the  Act  caused  little  fundamental  change  in  medical  record 
keeping. 

Decisions  of  the  Data  Inspectorate  on  licenses  for  new  automated  medical  systems 
have  established  several  main  points.    First,  the  information  that  is  usually  kept  in 
typical  medical  records  may  be  automated  unless  the  amount  of  information  is  so 
extensive  that  it  constitutes  a  comprehensive  description  of  an  individual.     In  such 
a  case,  the  personnel  who  have  access  to  the  system  must  be  sworn  to  secrecy,  and 
breaching  that  duty  carries  criminal  penalties.     Second,  information  collected 
especially  for  a  medical  system  must  be  given  by  the  patient  under  a  clear 
understanding  of  the  purpose  and  scope  of  the  system.     Third,  statistics  produced 
by  the  system  must  not  disclose  any  information  about  an  identifiable  individual. 
Fourth,  the  system  must  be  used  only  for  the  purpose  stated  in  the  application,  and 
only  the  approved  data  emd  processing  steps  may  be  used.     Fifth,  systems  used  in 
support  of  a  particular  research  project  must  be  purged  when  the  project  ends,  and 
the  permission  granted  by  the  Data  Inspectorate  in  such  instances  is  valid  only  for  a 
stated  period. 

In  cases  where  a  medical  system  raises  unusual  problems  due  to  the  sensitivity 
of  the  information,  the  Data  Inspectorate  has  not  hesitated  to  mandate  stronger 
safeguards..    For  example,  where  a  research  project  to  evaluate  the  success  of  an 
alcohol  clinic  would  gather  much  of  its  data  through  personal  interviews  with  the 
patients,  the  Inspectorate  set  especially  thorough  requirements  for  informed  consent. 
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According  to  the  Data  Inspectorate,  the  most  sensitive  aspects  of  medical 
records  so  far  have  involved  political  questions  connected  with  maintenance  of  the 
immigrant  children's  medical  register,  and  legal  issues  connected  with  a  narcotics 
register.     In  the  latter  case,  the  Inspectorate  is  aware  that  police  do  get 
information  from  automated  systems  on  occasion,  even  though  this  is  not  permitted; 
since  this  police  access  has  been  infrequent,  on  a  verbal  basis,  and  accomplished 
through  the  cooperation  of  narcotics  register  employees  with  authorized  access,  the 
Data  Inspectorate  does  not  feel  that  this  problem  can  be  solved  by  altering  the 
conditions  of  automated  files,  but  requires  strengthening  the  supervision  of  register 
employees. 

SUMMARY  ■  ' 

Looking  at  the  overall  patterns  of  computer  use  in  health  care  in  other 
democratic  nations,  we  can  draw  the  following  conclusions: 

(1)  computer  use  in  Europe  and  other  industrial  democracies  is  still  heavily 
centered  on  administrative  and  laboratory  applications  for  hospitals,  and 
administrative  and  claims-processing  operations  for  health  insurance  purposes; 

(2)  leading-edge  hospital  systems  are  still  experimenting  with  their  work  on 
automated  patient  records  and  patient  information  systems; 

(3)  only  a  small  number  of  clinics  and  hospitals  in  various  nations  are  working, 
slowly,  toward  a  unified  hospital  information  system; 

(k)  there  are  only  a  few  working  models  of  regional  health  information  systems; 

(5)  problems  of  cost- justification,  organizational  and  medical  opposition  to 
technological  innovation,  and  competition  between  medical  and  social  priorities  for 
money  and  management  attention  are  part  of  the  basic  scene  in  all  these  nations;  and 

(6)  national  health  information  systems  for  planning  and  public  health  purposes 

are  still  in  their  infancy. 

In  short,  while  computers  have  aided  in  administrative  aspects  of  health  care, 

and  have  made  some  valuable  contributions  to  direct  patient  services  in  other  nations, 

the  fundamental  problems  that  have  impeded  greater  use  of  and  greater  payoff  from 

computers  in  American  health  care  have  been  duplicated  in  other  nations,  and  remain 

the  issues  confronting  all  health  system  planners  today. 

As  far  as  protection  of  citizens  rights  in  medical  data,  and  especially  in  new 

automated  data  systems,  there  are  several  models  of  legal  protection  emerging  among 

the  industrialized  democracies,  paralleling  the  way  such  nations  are  dealing  with  the 

larger  records-and-privacy  issue  in  their  societies.     In  terms  of  what  has  already 

been  adopted,  one  model  is  represented  by  the  Swedish  Data  Act  smd  similar  regulation 

at  the  West  German  state  level.     Here,  automated  personal  data  systems  are  being 

officially  licensed,  with  detailed  regulation  and  continuing  oversight  assigned  to 

administrative  boards  or  commissioners.     Medical  data  systems  in  these  countries 

represent  one  type  of  system  covered  by  the  general  protective  scheme,  so  that  the 

definitions  of  privacy, confidentiality ,  and  individual  access,  and  the  safeguards 

required  in  such  systems  are  being  worked  out  by  the  regulatory  authorities  as 

initial  licensing,  practical  experience,  and  citizen  complaints  develop. 
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In  most  other  industrialized  democracies,  national  legislation  to  protect  privacy 
has  been  recommended  by  parliamentary  or  special  commissions  ajid  is  currently  under 
legislative  consideration,  with  adoption  of  various  schemes  reflecting  different 
national  political  cultures  virtually  certain  by  the  end  of  the  1970's.     In  some 
of  these  nations,  specific  safeguards  for  national  health  insurance  data  or  data  kept 
by  primary  care  providers  have  been  recommended,  as  in  Australia,  eind  such  measures 
will  probably  be  adopted  separately. 

What  is  especially  worth  noting  in  this  situation  is  the  widespread  agreement 
in  parliamentary  democracies  on  the  principles  of  citizen  rights  in  record  systems 
that  need  to  be  observed,  whatever  regulatory  mechanisms  may  be  chosen  to  enforce 
them.     There  is  general  consensus  that  data  systems  should  be  limited  to  the 
information  necessary  and  relevant  for  the  function  being  performed;  that  data  systems 
should  not  be  secret;  that  individuals  should  have  appropriate  notice  of  the  records 
kept  about  them  and  of  those  who  will  have  access  to  the  information;  and  that  proce-= 
dures  should  be  provided  to  allow  individuals  to  inspect  their  records  and  assure  their 
accuracy  and  completeness.    As  to  the  special  regulations  needed  for  computer 
systems,  the  British  White  Paper  of  1975  expressed  what  a  decade  of  alarms,  studies, 
and  public  debates  has  now  made  a  common  outlook  in  Western  nations: 

"The  time  has  come  when  those  who  use  computers  to  handle  personal  information, 
however  responsible  they  axe,  can  no  longer  remain  the  sole  judges  of  whether  their 
own  systems  adequately  safeguard  privacy.     The  safegusurds  must  become  subject  to 
independent  scrutiny." 
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CHAPTER  13:     POLICY  ANALYSIS  AND  RECOMMENDATIONS 

INTRODUCTION 

To  set  the  perspective  for  our  policy  analysis  and  recommendations,  three 
summary  observations  are  important: 

1.  Medical  records  and  health  data  are  being  used  today  in  an  enormous  variety 
of  settings,  with  computerization  present  in  all  of  them.    Our  report  has  traced 
such  use  in  doctors'  offices,  clinics,  health  centers,  and  hospitals;  in  governmental 
and  private  facilities;  in  acute  and  ambulatory  care;  in  physical  medicine  and 
psychiatric  treatment;  where  patients  could  choose  their  health  care  and  where  they 
are  under  various  institutional  controls  (prisons,  the  army,  mental  hospitals,  etc.). 
We  have  seen  that  beyond  primary  care  lie  important  uses  of  personal  medical  data 
for  service- payment ,  quality-care  review,  and  all  the  social  processes  we  discussed 
as  Zone  3  activities,  from  credit,  employment,  and  licensing  to  law  enforcement, 
social  research,  and  political  life. 

Given  this  great  diversity  of  settings,  there  is  no  single  public-policy 
intervention  that  can  be  expected  to  set  standards  for  the  protection  of  citizen 
rights  throughout  the  health  care  system  and  covering  all  other  health  data  uses. 
No  constitutional  amendment,  model  statute,  judicial  rule,  systems  guide,  or 
managers'  code  could  encompass,  by  itself,  all  the  important  problems  that  need 
attention,  nor  would  the  actions  of  any  one  of  these  policy-forming  authorities  be 
adequate  in  terms  of  regulatory  scope  and  supervisory  power.     Thus  our  initial 
assumption  is  that  wise  standards  will  require  a  mosaic  of  policies,  applied  by 
different  authorities  and  institutions  in  our  social  system,  hopefully  adding  up  to 
a  consistent  national  approach. 

2.  Members  of  the  project  team  (just  as  readers  of  this  report)  hold  differing 
views  about  how  American  health  care  should  be  organized,  financed,  and  conducted, 
as  well  as  on  the  issue  of  where  computers  can  and  cannot  be  used  to  good  advantage 
in  the  health-care  process.     But  we  take  it  to  be  a  paramount  requirement  of 
American  society,  based  on  its  concern  for  individual  dignity  and  humane  values, 
that  citizen  rights  should  be  adequately  protected  regardless  of  the  health-care 

or  computer-system  options  that  may  be  pursued  in  the  coming  years.     To  be  sure, 
some  models  of  health  care  or  information- system  plans  lend  themselves  more  easily 
than  others  to  the  installation  of  civil  liberties  guarantees,  and  there  are  some 
systems  (current  or  proposed)  that  are  so  potentially  violative  of  citizen  rights 
that  they  deserve  to  be  opposed  entirely.     But,  as  we  see  it,  our  objective  should 
be  to  assure  that  every  institution  now  collecting  or  using  personal  health  data 
observes  basic  guarantees  of  individual  rights,  and  that  every  reform  of  our  health 
care  systems  or  adoption  of  new  computer  applications  in  this  field  demonstrate  how 
it  will  follow  similar  policies.    We  cannot  allow  such  issues  of  citizen  rights  to 
become  matters  for  "later  consideration,"  to  be  seriously  addressed  only  after 
"more  basic  issues"  of  health  care  are  resolved. 

3.  While  the  need  to  protect  personal  medical  data  against  misuse  has  been 
recognized  recently  by  influential  voices  in  the  medical,  computer,  and  civil 
liberties  communities,  and  while  we  are  beginning  to  apply  important  new  laws  such 
as  the  federal  privacy  act,  we  have  still  not  moved  very  far  to  bring  health  data 
systems  under  a  set  of  guiding  principles  and  procedures.     To  reiterate  what  we 
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said  in  the  conclusion  to  Chapter  11 i 

"Most  computerized  health  data  systems  are  being  created  or 
expanded  without  sufficient  consultation  in  advance  with  groups 
representing  citizen  rights  and  doctor-patient  interests,  ajid 
without  some  kind  of  proceeding  open  to  the  general  public. 
Most  data  systems  lack  sufficiently  developed  ajialyses  of  how 
much  and  what  kind  of  identified  personal  data  they  really 
need  to  perform  their  function.    Even  when  properly  defined, 
most  data  systems  fail  to  adopt  sufficiently  precise  standards 
of  confidentiality,  controlling  uses  within  the  organization 
and  release  of  identified  data  to  third  parties.    When  it  comes 
to  rules  for  permitting  patient  access  to  their  own  records, 
very  few  computerized  organizations  have  adopted  procedures 
responsive  to  those  patients  who  ask  for  and  insist  upon 
^ocess . . .What  we  have  today  are  ambiguous  gmd  ill-defined 
systems  that  leave  people  uncertain  and  feairful  about  their 
capacity  to  control  the  circulation  of  their  medical  and  health 
data. " 

In  short,  while  we  are  not  without  some  useful  precedents  and  tools  for  the 
job,  securing  individual  rights  in  the  increasingly  computerized  world  of  health 
care  is  a  job  that  has  barely  begun. 

ELEMENTS  OF  A  NATIONAL  POLICY 

To  evolve  a  unified  national  policy,  we  need  to  (A)  adopt  a  coherent  theoretical 
approach  to  the  balancing  of  individual  and  social  interests  in  the  use  of  data 
systems;  (B)  apply  these  to  produce  basic  principles  or  standards  for  the  operation 
of  health  data  systems;  and  (C)  identify  some  current  priorities  for  policy  action  in 
the  health  area.    These  will  be  the  major  sections  of  our  discussion  in  this  chapter, 

A.  GENERAL  CONCEPTS  GOVERNING  DATA  SYSTEMS  IN  DEMOCRATIC  SOCIETY 

Looking  over  American  society's  encounters  with  the  privacy-smd-databanks 
issue  during  the  past  decade,  we  see  the  gradual  emergence  of  a  set  of  basic  concepts 
that  command  a  wide  public  concensus  today,  and  cam  be  drawn  upon  with  great  value 
in  making  policy  choices  in  the  health  field.    Since  these  ideas  have  been  discussed 
at  great  length  elsewhere,      we  will  present  them  only  briefly,  in  the  expectation 
that  probing  their  conceptual  strengths  and  weaknesses,  and  applying  them  to  real- 
world  situations,  will  be  the  work  ahead  for  many  years. 


*See,  for  example,  Westin  gind  Baker,  Databanks  in  a  Free  Society  (N.Y,«  Quadrangle, 
1972)  and  Records, Computers .  and  the  Rights  of  Citizens.  Report  of  the  Secretary's 
Advisory  Committee  on  Automated  Personal  Data  Systems,  U.S.  Department  of  Health, 
Education,  and  Welfare,  July,  1973f  DHEW  Publication  No.  (OS)  73-7^^. 


270 


1 .  The  "contract"  theory  of  informational  privacy 

In  a  democratic  society,  which  seeks  to  assure  "both  individual  freedom  and  a 
rationally-ordered  social  system,  the  way  in  which  personal  information  is  treated  is 
of  special  importance.     The  traditional  advocacy  of  privacy  rights  in  information  has 
been  couched  largely  in  civil- liberties  terminology — the  right  of  ein  individual  to 
determine,  in  most  circumstances,  what  information  about  him  is  obtained  and  used  by 
others.    But  at  least  where  organizational  data  systems  are  involved,  there  is  growing 
recognition  of  what  might  be  called  an  exchange  theory.     The  concept  here  is  that  an 
individual,  exercising  his  right  to  give  or  withhold  personal  information,  releases 
valuable  personal  data  either  in  order  to  obtain  a  specific  benefit  for  himself  (or 
his  family  or  group,  or  to  promote  a  social  good  he  supports)  or  else  to  fulfill  a 
legal  duty  (carrying  the  sanction  of  majority  will  under  democratic  theory).  In 
return,  the  recipient  (the  data  user)  has  two  basic  obligations:     to  use  the  personal 
information  only  for  the  purpose  agreed  upon( unless  authorized  by  additional  consent 
or  by  law),  and  not  to  treat  the  information  so  carelessly  or  maliciously  that  it 
harms  the  individual  from  whom  it  was  obtained. 

What  this  exchange  or  contract  theory  of  information  privacy  recognizes  is  that 
personal  information  has  become  increasingly  valuable  in  our  data-based  civilization. 
Our  personal  characteristics,  once  thought  of  solely  in  civil  libertarian  terms  as 
entitled  to  protection  against  unwonted  surveillance  or  disclosure,  have  become  the 
vital  raw  material  of  business,  governmental,  and  political  decision-making:  age, 
marital  status,  children,  income,  race,  education,  buying  habits,  political 
preferences,  religious  denominations,  health  conditions  etc.     If  individuals  were  to 
withhold  such  personal  information  from  those  who  daily  ask  for  it,  business  and 
governmental  affairs  would  be  seriously  disrupted,  since  organizational  planning, 
administration,  and  evaluation  depend  heavily  on  access  to  such  individual  data.  Thus, 
whatever  it  may  have  been  in  earlier  centuries,  personal  information  has  become,  like 
clean  air  and  water,  a  scarce  commodity  today,  capable  of  being  valued  in  an  economic 
sense  alongside  its  social  worth  in  terms  of  protecting  individual  dignity  and 
democratic  values. 

Making  informational  privacy  a  property  right  as  well  as  a  human  right  does 
something  useful  in  a  capitalist  society:  it  buttresses  the  individual's  claim  to 
assert  (or  at  least  to  share)  control  over  the  uses  made  of  his  or  her  valuable 
property.     It  also  explains  why  there  should  be  a  reciprocal  duty  on  the  part  of  the 
data  user  to  live  up  to  his  side  of  the  informational  contract  -  not  to  be  guilty  of 
unjust  enrichment  at  another's  expense.     Whether  as  a  basis  for  legislation  or 
judicial  decision,  or  to  explain  to  the  public  the  implied-contract  relationship  that 
should  be  seen  arising  between  data  subject  and  data  user,  this  concept  has  great 
merit  for  public  policy.* 

*This  formulation  parallels  the  concept  of  "mutuality"  used  in  the  fair  information 
practices  literature.    For  a  recent  discussion  of  this  concept,  see  John  P.  Panning, 
David  B.H.  Martin,  and  Susan  Bennett,  "Pair  Information  Practice  for  Health  and 
Medical  Records,"  a  paper  prepared  for  the  Conference  on  the  Confidentiality  of  Health 
Records,  Key  Biscayne,  Plorida,  Nov.  6-9,  1974. 


271 


2.  The  special  dangers  of  automated  data  systems 

After  two  decades  of  experience  with  automated  data  systems,  we  should  recognize 
that  these  are  mechanisms  highly  subject  to  surprise.      Anyone  who  has  followed  the 
rapidly  changing  technology  of  computers  and  communication  systems  knows  that  these 
enormously  powerful  tools  have — in  the  hands  of  human  users — consistently  done  either 
unexpected  things  or  expected  things  in  unexpected  ways.    Each  generation  of 
computers  has  these  "hugs"  worked  out,  but  each  new  generation  of  computer- 
communications  technology  also  brings  new  operating  principles  and  new  constellations 
of  hardware  and  software  that  create  new  "bugs"  to  be  resolved.     This  is  not  to  say 
that  computers  should  not  be  used,  or  that  harm  must  be  taken  as  inevitable.  But 
until  we  are  much  farther  down  the  road  to  a  stable  and  disciplined  technology  than  we 
now  are,  we  must  constantly  take  it  for  granted  that  automated  systems  have  a 
propensity  to  go  awry.    Where  risks  to  citizen  rights  are  involved,  this  calls  for 
special  attention  in  the  planning  process,  and  close  monitoring  on  a  continuing  basis. 

3.  The  emergence  of  the  "data  keeper"  concept 

For  practical  as  well  as  legal  reasons,  it  has  become  clear  that  the  organization 
that  owns  a  data  system  is  the  party  responsible  for  its  ethical  use.    Others  may 
share  that  responsibility  (someone  else  who  funds  the  venture,  regulatory-agencies, 
etc.),  as  well  as  those  helping  process  the  data  for  the  owner  (e.g.,  a  computer 
service  bureau).    But  a  non-transf errable  set  of  duties  attaches  to  what  the  Swedish 
Data  Protection  Law  calls  the  "keeper" .     These  duties  run  in  two  directions — to  the 
individuals  about  whom  the  data  relate  and  also  to  the  larger  society.     The  latter 
duty  arises  because  the  operations  of  major  data  systems  affect  more  than  the  data 
subjects;  their  operations  affect  the  general  public  which  hears  about  them,  and  will 
also  contribute  to  general  norms  of  organizational  responsibility  (or  irresponsibility) 
in  the  larger  society. 

4 .  A  legal  duty  to  take  reasonable  care 

We  have  already  mentioned  the  ethical  duties  of  data  system  keepers.     What  seems 
to  be  evolving  gradually  in  the  privacy-and-databanks  debate  is  a  general  standard  by 
which  to  measure  the  performance  of  those  ethical  duties,  and  to  transform  these  into 
legal  obligation.     Simply  put,  this  says  that  any  organization  which  creates  a  data 
system  that  does  not  provide  adequate  policies  to  safeguard  citizen  rights  and  does 
not  utilize  appropriate  data-security  measures,  creates  unreasonable  risks  to  society's 
interest  in  protecting  individual  rights,  and  should  be  held  legally  accountable  for 
its  failure  to  take  such  measures. 

This  notion  reflects  the  classic  "reasonable  man"  standard  used  by  Anglo- 
American  courts  to  measure  liability  in  tort  law.     It  rests  on  the  assumption  that  the 
creation  of  automated  information  systems  is  generally  a  valuable  activity  for 
society  but    that  it  also  generates  foreseeable  risks  of  harm  to  personal  and  property 
rights.     To  deter  such  risks  of  harm,  there  could  be  statutes  or  regulatory-agency 
rules  spelling  out  what  constitutes  adequate  policies  and  appropriate  data-security 

*For  a  good  presentation  of  this  view,  see  J.J.  Hellman,  Privacy  and  Information 
Systems:  An  Argument  and  an  Implementation,  Rand  Corporation  Paper,  p-4298.  May, 
1970,  p.  62.  
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measures  for  a  given  type  of  record-keeping  activity  or  field.    But  even  in  the 
absence  of  such  legislation,  the  standard  might  be  applied  by  courts  under  the  common 
law,  to  hold  organizations  liable  for  damages  or  subject  to  injunctive  order  if  they 
had  not  followed  the  standard  of  care  considered  by  the  courts  to  be  reasonable  for 
their  industry  or  governmental  function. 

5 .  General  requirements  for  demonstrating  "reasonable  care" 

It  is  clear  that  the  proper  balance  between  claims  of  citizen  rights  and 
organizational  needs  for  personal  information  will  vary  from  area  to  area.     But  in 
every  field,  we  are  beginning  to  recognize  that  certain  general  standards  should  be 
observed: 

A.  Only  information  relevant  to  the  organization's  legitimate  purposes  should 
be  collected  and  stored,  and  the  definition  of  relevance  must  respect  both 
constitutional  guarantees  of  privacy  and  prohibitions  against  making  improper  racial, 
sexual,  cultural,  and  similar  discriminatory  decisions. 

B.  The  managers  of  a  data  system  must  take  adequate  steps  to  insure  that  the 
records  it  keeps  are  accurate,  timely,  and  complete,  as  measured  by  the  kinds  of 
uses  made  of  the  data  and  the  social  impact  of  their  use. 

C.  Detailed  rules  of  confidentiality  should  govern  who  within  the  organization 
maintaining  the  data  system  has  access  to  a  record,  and  this  should  be  based  on  a 
need-to-know  principle. 

D.  Disclosure  of  personal  data  outside  the  organization  that  collected  it  should 
be  made  only  with  the  informed  and  voluntary  consent  of  the  individual,  obtained  at 
the  time  of  collection  or  by  subsequent  query,  or  under  a  constitutionally- valid  legal 
order. 

E.  An  individual  should  have  a  right  to  see  his  or  her  record,  and  have  an 
effective  procedure  for  contesting  the  accuracy,  timeliness,  and  pertinency  of  the 
information  in  it.     There  may  be  some  exceptions  to  this  right  of  inspection,  in 

the  interests  of  protecting  confidential  sources,  but  these  should  be  rare,  and  never 
allowed  if  the  record  is  used  to  make  judgments  affecting  the  individual's  rights 
and  benefits. 

6.  The  requirement  of  public  notice 

The  concept  from  the  HEW  report  that  secret  data  systems  should  not  be  used  to 
make  judgments  about  people  has  been  widely  accepted.    But  beyond  announcing  the 
existence  of  all  personal  data  systems  lies  the  need  for  society  to  have  the  creation 
and  expansion  of  data  systems  reported  to  the  public  in  ways  that  indicate  their 
potential  impact  on  citizen  rights,  and  that  provide  the  basis  for  informed  public 
discussion  of  such  impact.     This  would  be  the  equivalent  of  the  "environmental  impact" 
statement  developed  recently  by  federal  and  state  law.     The  review  of  such  notice 
might  be  lodged  under  a  variety  of  supervisory  authorities  depending  on  the  field 
involved,  and  there  would  have  to  be  different  standards  for  different  information 
systems.    What  is  critical,  however,  is  to  establish  the  principle  that  creation  of 
personal  data  systems  is  too  important  to  treat  as  an  internal  management  prerogative. 
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7.  The  concept  of  independent  review 

Finally,  the  operations  of  every  personal  data  system  ought  to  be  subject  to 
regular  inspection  and  evaluation  by  some  kind  of  outside,  independent  body,  such  as 
a  professional  licensing  association,  regulatory  agency,  or  governmental  commission. 
In  many  cases ,  that  independent  body  should  be  empowered  to  hear  individual  complaints 
about  the  operations  of  the  data  system,  and  to  exercise  an  ombudsman  function  where 
such  complaints  have  validity. 

The  concepts  just  discussed  represent  a  theoretical  framework  for  insuring  that 
the  operations  of  data  systems  are  consistent  with  citizen  rights  in  a 
democratic  society.    For  our  purposes,  the  challenge  is  to  apply  their  general  ideas 
to  the  special  conditions  of  health  care ,  and  to  the  lengthening  uses  of  health  data 
throughout  American  society.     It  is  to  that  task  that  we  turn  now. 

B.  APPLYING  THESE  CONCEPTS  TO  HEALTH  DATA  SYSTEMS:       12  BASIC  PRINCIPLES  FOR  HEALTH 
DATA  SYSTEMS 

At  present,  there  is  an  uneven  fit  between  these  concepts  for  the  proper  conduct 
of  data  systems  and  the  way  that  American  law  and  social  practice  deal  with  health 
data.    Historically,  the  duty  of  physicians  to  keep  patient  data  confidential,  as  it 
arose  in  the  Hippocratic  tradition,  was  a  valuable  recognition  of  the  need  for  frank 
communication  by  the  patient  to  the  physician  and  observance  of  confidentiality 
vis  a  vis  the  outside  world.    But  the  Hippocratic  tradition  also  embodies  the  ideas 
that  physicians  must  protect  the  mysteries  of  the  medical  profession  from  common  view, 
as  well  as  to  inform  the  patient  only  of  what  the  physician  feels  the  patient  should 
know  about  his/her  medical  condition.     These  elements  of  secrecy  and  unilateral 
decision-making  are  not  consistent  with  either  citizen  rights  concerns  or  the  growing 
"partnership"  theory  of  doctor-patient  relationships  advocated  by  health-consumer 
movements.    Furthermore,  current  law  and  practice  as  to  circulation  of  patient  data 
beyond  the  primary-care  facility  (through  releases  and  implied- consent  doctrines) 
leave  much  to  be  desired,  as  do  the  weak  statements  as  to  "confidentiality"  that 
appear  in  most  statutes  purporting  to  protect  health  data  when  this  is  collected  for 
social  uses. 

What  then  should  be  the  principles  that  are  applied  to  the  use  of  medical  records 
axid  health  data?    We  will  present  here     12  major  principles  that  we  think  need  to  be 
defined  and  applied  whenever  an  automated  data  system  is  used  in  the  health  system. 
While  we  focus  on  automated  systems,  since  that  represents  the  special  interest  of 
our  study,  most  of  the  principles  that  we  discuss  would  apply  also  to  manual 
systems,  and  should  be  helpful  to  those  involved  in  those  operations  as  well. 

Wherever  possible,  we  will  illustrate  policy  alternatives  with  examples  of 
organizations  that  we  found  presently  following  such  innovative  or  exemplary 
approaches.     In  this  way,  we  hope  to  show  that  recommended  steps  are  not  Utopian 
proposals  but  policies  that  can  be  successfully  and  practically  instituted  by 
organizational  managers . 
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1 .  Requiring  Public  Notice  and  Impact  Statements 
Principle 

Whenever  an  automated  data  system  with  identified  personal  records  is  to  be 
created  for  health  care,  service-payment,  quality-assurance,  medical  research,  or 
supervisory  administration  over  health  care,  a  notice  should  be  filed  with  an 
appropriate  outside  authority  and  communicated  to  any  continuing  population  of 
individuals  whose  records  will  be  affected.     A  procedure  should  be  provided  for 
interested  persons  and  groups  to  appear  and  make  their  views  known  on  the  proposed 
data  system,  especially  as  to  the  adequacy  of  its  measures  to  protect  citizen  rights. 
To  help  focus  that  public  discussion,  the  organization's  notice  should  include  a 
"privacy  impact"  statement  describing  the  ways  in  which  the  proposed  automated  data 
system  would  affect  existing  policies  and  procedures  relating  to  citizen  rights  in 
that  organization's  use  of  personal  data. 

Discussion 

The  notice  concept  proposed  here  is  similar  to  that  now  required  of  federal 
agencies  under  the  Federal  Privacy  Act  of  197^.     It  rests  on  the  belief  that  the 
creation  of  an  automated  data  system  is  of  sufficient  importance  to  the  individuals 
affected,  to  public  confidence  in  the  health-care  system,  and  to  democratic  society 
as  a  whole  that  it  ought  not  to  be  carried  out  through  internal,  managerial  decision- 
making, like  ordering  a  new  photocopier  or  changing  the  paint  color  in  the  hallways. 

The  content  of  the  notice  would  vary  somewhat, depending  on  the  type  of 
organization  involved.     However,  its  basic  elements  ought  to  include «  the  data 
system's  purposes j  the  types  of  information  to  be  collected  and  stored;  the  regular 
uses  intended  to  be  made  of  the  data;  the  rules  for  confidentiality  and  data-access 
within  the  organization;  the  rules  for  releasing  identified  data  to  outsiders;  the 
provisions  for  access  to  and  review  of  their  records  by  the  data  subjects;  the 
provisions  for  assuring  accuracy  and  timeliness  of  data,  and  purging  stale  data;  and 
the  data  security  measures  to  be  followed. 

A  notice  system  of  this  kind  (published  in  the  Federal  Register)  is  already 
mandated  by  the  Federal  Privacy  Act  for  federal  agencies,  including  those  involved 
in  health  activities.     However,  no  privacy  impact  statement  or  advance  notice  to  data 
populations  are  required  in  that  legislation  nor  is  there  any  federal  commission  or 
regulatory  agency  empowered  to  approve  or  disapprove  a  data  system  plan.  Notice 
requirements  similar  to  the  federal  act  sure  used  in  the  five  states  that  have  passed 
fair  information  practices  acts  for  state  and  local  governmental  agencies.    How  well 
such  notice  systems  are  working  so  far,  ajid  whether  centralized  review  ought  to  be 
instituted  are  issues  we  will  discuss  later  in  this  chapter. 

How  private  health  organizations  and  all  state  health  facilities  could  be 
brought  into  a  notice  and  impact-statement  system  raises  some  difficult  policy 
issues,  especially  as  to  the  body  that  would  receive  the  notices  and  the  kind  of 
hearings  process  that  would  be  conducted.     The  alternatives  range  from  the  most 
voluntary  options  to  the  most  regulated  ones. 

At  the  voluntary  end  of  policy  spectrum  would  be  a  system  that  required 
organizations  simply  to  issue  the  notice,  publish  it  in  a  reasonably  accessible 
place,  receive  whatever  reactions  might  be  forthcoming  during  a  waiting  period,  sind 
then  adopt  whatever  the  managers  considered  to  be  useful  suggestions  in  the 
implementation  of  the  system  plan. 
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A  more  supervised  approach  would  be  for  some  private  body  (such  as  a  commission 
comparable  to  the  Joint  Commission  on  Hospital  Accreditation),  or  a  state  health 
agency,  or  state  fair  Information  practices  commission,  or  the  federal  Department  of 
HEW,  or  a  federal  privacy  commission,  to  be  designated  by  legislation  to  receive 
such  system  notices  and  hold  formal  hearings  on  them.     This  plan  would  not  lodge 
decision-making  power  in  the  central  body  but  would  see  it  simply  as  a  collector  of 
notices  and  forum  for  responses,  possibly  with  a  recommendatory  role. 

Finally,  the  notices  could  be  handled  in  the  manner  of  the  Swedish  Data 
Protection  Board,  which  licenses  all  automated  data  systems,  governmental  or  private. 
I     Under  Swedish  law,  every  hospital,  health  center,  health  insurance  bostrd,  disease 

registry,  or  medical  research  project  must  furnish  the  kind  of  notice  described 
I     above  as  part  of  the  registration  process,  and  the  Data  Board  must  approve  the 
policies  and  safeguards  before  a  license  will  be  issued.    Any  one  of  the  three 
authorities  already  noted  --  a  private  body,  a  state  agency,  or  a  federal  agency  — 
could  be  given  such  registration- type  authority  for  health  data  systems  in  the 
United  States. 

There  are  pros  ajid  cons  in  each  of  these  alternatives,    A  national  authority 
that  had  approval  or  disapproval  power  in  the  Swedish  style  would  represent  a  large 
extension  of  federal  supervisory  authority  over  the  operations  of  private  ajid  state 
I     health  facilities,  with  risks  not  only  of  over-rigid  federal  controls  but  also  of 
potential  misuse  of  power  by  federal  authorities.     How  such  a  commission  staffed  by 
the  President's  men  would  have  helped  in  Richard  Nixon's  quest  for  derogatory  data 
on  his  "enemies"  must  be  in  the  minds  of  anyone  considering  the  creation  of  a 
federal  board  having  control  over  the  future  medical  record  systems  of  the  nation. 
Even  if  such  a  federal  body  were  given  only  the  authority  to  receive  organizational 
notices  and  conduct  hearings,  or  issue  advisory  recommendations,  this  would  give 
the  federal  agency  a  considerable  leverage  over  state  and  private  health 
organizations. 

On  the  other  hand,  while  looking  to  state-govemment  authorities  to  regulate 
themselves  and  private  organizations  would  have  the  value  of  keeping  supervision 
closer  to  the  local  level,  and  decentralizing  supervisory  power,  it  would  probably 
involve  a  lengthy  period  while  the  50  states  enacted  such  measures,  as  well  as  the 
likelihood  of  inconsistencies  in  standards  from  state  to  state. 

Going  the  private -commissi on  route  for  private  health  organizations  has  the 
advantage  of  strengthening  private  autonomy  and  fostering  self -regulation,  and 
would  probably  be  supported  strongly  by  the  private  sector  if  it  felt  that  government 
control  would  otherwise  be  enacted.    However,  the  ability  of  a  voluntary  organization 
to  enforce  standards  is  often  quite  limited,  and  many  critics  of  the  Joint  Commission 
would  say  that  its  record  demonstrates  just  that  point  in  the  hospital  field. 

It  may  well  be  that  most  individuals  will  make  a  policy  choice  here  based  on 
their  general  philosophy  about  governmental  power  and  private  autonomy,  as  well  as 
their  preferences  between  federal  and  state  roles  in  the  political  system.  Some 
observers  may  wish  to  reserve  judgment  temporarily  until  some  experience  has  been 
recorded  as  to  how  federal  agencies  have  fared  with  the  public  notice  requirement 
of  the  federal  privacy  act,  to  see  whether  more  state  legislation  begins  to  fill 
the  current  regulatory  vacuum,  amd  whether  private  health  organizations  adopt  such 
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public  notice  techniques  as  a  matter  of  voluntary  practice.     For  the  purposes  of 
this  report,  the  principle  of  public  notices  and  impact  statements  has  been  presented 
as  something  that  ought  to  be  done,  whatever  the  particular  authority  that  may  be 
installed  to  administer  the  process. 

Another  element  of  the  notice  system  proposed  here  is  that  any  continuing 
population  of  individuals  that  will  be  affected  by  computerization  should  receive 
clearly-written  description  of  what  is  proposed  before  the  data  system  is  installed. 
This  would  include  families  registered  at  a  community  health  center  such  as  Martin 
Luther  King  Jr.,  subscribers  to  health  insurance  policies,  persons  working  for  an 
industrial  corporation  automating  its  employee  health  data,  and  similar  groups. 
This  concept  assumes  that  individuals  have  a  right  to  advance  notification,  not 
merely  a  statement  of  what  has  been  done.    Any  person  who  might  feel  so  disturbed 
at  how  this  data  system  was  being  set  up  would  then  be  able  to  assert  his  or  her 
complaints,  raise  issues  publicly,  and,  as  an  ultimate  step,  withdraw  from  being  a 
patient,  policyholder,  employee,  or  other  participant  in  that  organization's 
affairs . 

This  idea  of  advance  notice  may  seem  excessive  to  some  observers,  involving 
some  costs  in  money  and  delays  in  schedules  for  automation.     But  humane  health  care 
involves  unique  concerns  about  the  trust  and  confidence  of  patient  populations  in 
those  who  are  providing  them  with  care,  or  paying  for  health  services.     As  we  look 
ahead  to  the  increasing  use  of  automated  health  care  records,  lifetime  patient 
histories,  disease  surveillance  registers,  and  other  potentially  valuable  uses  of 
information  technology,  assuring  that  patients  feel  they  have  meaningful  control 
over  what  is  done  with  their  information,  including  a  right  to  opt  out  of  one  type 
of  record-keeping  system  and  to  choose  another  that  better  suits  their  values, 
represents  an  important  step  in  democratizing  the  uses  of  technology. 

■2.  Sel;ting  Proper  Limits  on  the  Uollection  ang  Kecording  of  Personal  Health  Data 
Principle 

An  organization  creating  a  health  data  system  should  examine  whether  the 
collection  and/or  recording  of  each  element  of  personal  health  information  is 
essential  for  carrying  out  the  organization's  proper  functions.  Socially-acceptable 
standards  of  relevance  and  propriety  should  be  worked  out  for  the  data  systems  in 
each  of  the  three  zones  of  health  data  use,  through  public  discussion  and  appropriate 
policy-setting  mechanisms. 
Discussion 

A .  Primary  Care:  Zone  1 

Where  primary  health  care  is  being  provided,  from  doctor's  office  to  clinic 
and  hospital,  we  saw  that  the  current  trend  is  to  collect  and  record  a  wide  range 
of  information  about  the  patient,  including  personal  and  family  history,  social 
activities,  alcohol  and  drug  use,  sexual  patterns,  emotional  and  psychological 
problems,  and  much  other  sensitive  data.     Computerization  leads  to  more  systematic 
recording  of  these  data,  and  their  availability  to  personnel  (other  than  physicians) 
sharing  in  the  primary-care  process. 

Since  extensive  disclosure  by  patient  to  health  professional  is  voluntarily 
given,  is  needed  for  effective  care,  and  is  the  area  of  confidential  communication 
best  protected  by  existing  law  and  social  norms,  many  thoughtful  leaders  in  the 
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health  field,  including  some  who  are  strong  advocates  of  consumer  rights  and  civil 
liberties  in  health  care ,  urge  that  new  privacy  rules  ought  to  avoid  any  intervention 
as  to  what  is  collected  for  primary  care.    Dr.  Lawrence  Weed,  for  example,  argues 
that  too  little  personal  and  social  data  is  usually  collected  today  in  primary  care, 
not  too  much.     In  his  own  facility  in  Vermont,  where  an  experimental  automated 
problem-oriented  record  is  being  used,  the  data-collection  forms  and  progress  notes 
produce  an  extremely  detailed  personal,  social,  and  medical  history  for  each  patient, 
and  Weed  sees  this  as  a  vital  part  of  a  patient-oriented  health-care  process.^  Both 
from  principle  and  experience,  therefore,  Weed  is  strongly  opposed  to  law  or  regu- 
lation setting  relevancy  limits  on  what  is  collected  or  recorded  for  direct  patient 
care . 

The  acceptability  of  Weed's  position  may  well  turn  on  what  other  rules  society 
is  willing  and  able  to  apply  to  the  uses  and  flows  of  such  health  data  from  primary 
care.     That  is,  if  patients  are  given  the  right  to  know  what  is  in  their  primary 
care  records,  if  their  voluntary  consent  is  required  before  information  is  released 
from  those  records  for  all  uses  beyond  primary  care,  and  if  the  law  were  to  safeguard 
such  data  far  better  from  compulsory  disclosure  for  non-medical  uses  than  it  now 
does,  then  society  could  take  a  favorable  view  of  highly-sensitive  personal  data 
being  recorded  in  primary  care  data  systems.     But  if  these  policies  and  safeguards 
are  not  installed,  then  the  claims  of  primary  care  facilities  to  record  such 
extensive,  sensitive  information  must  be  evaluated  in  terms  of  their  likely  uses 
and  exposures  beyond  the  care  facility. 

We  will  be  discussing  how  to  deal  with  patient  access >  informed  consent,  and 
social  uses  of  medical  records  in  later  sections.     What  needs  noting  here  is  that 
society  simply  cannot  accept  the  health  professional's  plea  for  unbounded  data 
collection  and  full  recording  in  data  systems  unless  there  are  iron-clad  guarantees, 
enforceable  at  law,  that  the  patient's  rights,  benefits,  and  opportunities  in  the 
larger  society  will  not  be  harmed  by  production  of  his  or  her  self-revelations  from 
primary-care  records.     This  means  that  all  health  professionals  who  seek  the  advan- 
tages of  extensive  data  collection  for  primary  care  will  have  to  commit  themselves 
fully  to  the  installation  of  legal  protections  for  those  data,  or  else  risk  public 
opposition  to  such  systems  as  creating  too  great  a  danger  for  citizen  rights. 
B.  Service  Payment  and  Quality-Care  Assurance 

When  standards  of  relevancy  and  propriety  are  sought  in  the  area  of  service 
payment,  we  must  treat  the  underwriting/ eligibility  process  separately  from  the 
claims  process.     In  underwriting  of  private  health  insurance,  society  has  —  until 
recently  —  allowed  the  profit  and  non-profit  firms  to  use  whatever  standards  they 
wished  in  selecting  persons  to  insure.     Since  there  was  thought  to  be  no  legal  "right" 
to  health  insurance,  any  more  than  a  right  to  have  a  food-freezer  contract  or  a 
pest-exterminator  for  one's  home,  this  was  treated  as  a  commercial  service  offered 
to  consumers,  subject  only  to  the  anti-fraud  controls  of  general  consumer  protection. 

During  the  past  decade,  however,  using  race  as  an  overt  criterion  for  health 
insurance  has  been  forbidden  by  law.     Offering  different  policy  benefits  to  males 
as  opposed  to  females  within  the  same  occupational  group  or  other  classification 
have  been  attacked  before  state  regulatory  commissions  and  in  the  courts,  and  the 
health  insurance  industry  has  recently  adopted  a  policy  against  such  discrimination. 


278 


The  same  is  true  of  homosexuality,  where  regulatory  hearings  in  Pennsylvania  prompted 
a  health  industry  statement  that  homosexuality  per  se  would  not  be  used  as  a  basis 
for  turning  down  an  applicant.     Certain  physical  handicaps  that  once  were  used  to 
decline  policy  applications  have  been  receiving  similar  reconsideration,  as  a  result 

of  group  pressures;  for  example,  Florida  recently  enacted  a  statute  forbidding  under- 
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writers  to  refuse  health  policies  to  paraplegics  solely  because  of  that  disability. 

On  the  other  hand,  health  insurers  do  look  at  "life  styles,"  and  will  reject 
persons  whose  health  habits  or  style  of  living  create  special  risks  of  health  problems. 
These  have  generally  been  accepted  by  regulatory  authorities,  as  with  writing  special, 
low-cost  policies  for  persons  who  do  not  smoke  or  drink  alcoholic  beverages,  or  use 
addictive  drugs. 

Society  clearly  has  a  right  to  define  the  criteria  it  will  allow  insurers  to 
use  in  writing  insurance  policies,  in  health  or  any  other  insurance  line.     We  should 
recognize  that  what  we  are  doing  by  such  interventions  is  socializing  certain  risks. 
Since  the  companies  cannot  survive  by  losing  money,  all  policy-holders  will  have  to 
pay  the  cost  of  not  allowing  the  companies  to  exclude  persons  whose  conditions  may, 
in  fact,  lead  to  higher  than  average  costs  of  morbidity  or  disability,  or  earlier 
mortality.     That  is  one  way  society  can  prevent  continued  harm  being  done  to  persons 
whose  "objective"  situation  is  the  product  of  past  social  and  legal  discrimination. 
Whether  through  industry  self-regulation,  the  state  insurance  regulation  process, 
amendments  to  the  Fair  Credit  Reporting  Act,  or  recommendations  for  Congressional 
action  by  the  Privacy  Protection  Study  Commission,  new  standards  of  relevance  and 
propriety  in  the  health  underwriting  process  should  be  a  major  effort. 

Effectively  monitoring  these  standards  for  compliance  will  involve  scrutinizing 
the  application  forms  of  health  insurers,  the  investigative  or  "inspection"  reports 
about  applicants  done  by  their  own  underwriting  departments  or  outside  commercial 
reporting  agencies,  the  reports  of  examining  physicians  where  these  are  used,  the 
examinations  that  are  done  of  the  individual's  medical  records  under  release 
procedures,  and  the  propriety  of  the  uses  made  of  data  properly  collected.    An  example 
of  the  latter  problem  is  that  street  address  is  a  perfectly  legitimate  informational 
item  to  collect,  and  necessary  for  communication  with  the  applicaint;  but  if  it  is 
used  to  reject  applicants  from  sections  of  communities  known  to  be  predominantly 
black  or  Puerto  Rican,  that  would  be  a  racially-discriminatory  policy  to  be  prevented. 

When  we  turn  to  the  claims  process,  we  must  start  with  the  recognition  that 
identification  of  the  individual,  description  of  the  service  provided,  a  diagnosis 
of  the  condition,  and  similar  key  information  is  absolutely  essential  to  determine 
coverage  (or  eligibility)  under  a  contract  or  program.     Such  data  are  also  needed 
to  control  fraudulent  practices  by  practitioners  and  institutions,  and  to  supply  a 
data  base  from  which  to  determine  future  rates,  coverages,  and  programs.    As  long  as 
payment  for  American  health  care  is  based  on  a  combination  of  the  patient's  funds, 
insurance  coverages,  and  government  reimbursement  programs,  the  claims  review  process 
must  obtain  such  personally-identified  information.     In  this  sense,  service  payers 
are  right  in  asserting  that  they  are  central  (and  legitimate)  participants  in  the 
American  health-service  process,  not  interlopers. 

However,  the  legitimacy  of  the  payer  function  has  been  used,  too  often,  as  an 
excuse  for  collecting  and  retaining  more  personal  information  for  the  claims  process 
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than  the  function  requires.     We  found  that  a  lack  of  trust  in  the  confidentiality 

rules  and  practices  of  claims  payers  (as  a  whole)  was  widespread  among  psychiatrists, 

internal-medicine  practitioners,  medical  record  administrators  and  other  professional 

•5 

groups,  and  was  being  increasingly  voiced  by  consumer  and  civil  liberties  groups. 

The  problems  to  be  overcome  are  not,  in  fairness,  exclusively  those  of  the 
service  payers.     When  hospital  personnel  find  it  easier  and  cheaper  to  send  out  a 
photocopy  of  an  entire  medical  record  or  hospital  discharge  summary,  rather  than 
extract  the  specific  information  asked  for  by  the  payer,  then  the  harm  to  confiden- 
tiality arises  from  the  hospital's  conduct,  not  the  service  payer's.    Or,  when  some 
psychiatrists  use  vague  and  uncommunicative  terminology  in  a  deliberate  effort  to  get 
reimbursements  for  patients  whose  condition  —  if  accurately  described  —  would  not 
be  covered  by  a  contract  or  program,  and  this  prompts  the  service  payer  to  ask  for 
more  details  on  which  to  base  an  accurate  judgment,  this  leads  to  a  weakening  of 
confidentiality  for  which  those  psychiatric  practitioners  must  share  responsibility. 

The  need  to  clarify  relevancy  standards  for  claims  review  has  prompted  a  number 
of  recent  actions.    For  example,  we  noted  in  Part  One  that  the  National  Association 
of  Blue  Shield  Plans  had  adopted  in  September  of  1 975  a  set  of  "Guidelines  on  Pre- 
serving Confidentiality  of  Medical  Records."^    In  the  section  on  "Internal  Access 
and  Handling  of  Pledical  Information,"  the  Guidelines  state: 

"3.  Plan  employees  should  seek  only  those  data  necessary  to 
adjudicate  a  claim,  case  or  utilization  patterns  and  profiles." 
The  discussion  of  this  says:  "For  example,  if  the  Plan  needs  only  a  discharge  summary 
or  consultation  report,  it  should  not  ask  the  hospital  or  physician  for  the  entire 
record.     To  do  so,  not  only  creates  storage  problems,  but  also  places  unnecessary 
burdens  on  those  mechanisms  which  are  meant  to  insure  confidentiality." 

Paralleling  this  guideline,  leaders  in  the  medical  records  profession  have 

called  on  hospitals  "to  maintain  stricter  quality  controls  on  information  sent  to 
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insurance  companies."      Their  proposals  include  hospitals  requiring  insurance  com- 
panies to  specify  "why  and  what  information  is  necessary"  when  they  request  data 
beyond  that  clearly  necessary  to  review  a  claim,  and  to  return  to  the  hospital  the 
copy  of  a  patient's  medical  record  within  a  specified  period  of  time,  or  destroy  it 
after  the  claims  review  process  is  completed. 

Some  medical  organizations  have  been  negotiating  with  health  insurers  and  their 
associations  to  work  out  better  standards.    For  exsimple,  the  Union  of  American 
Physicians  and  Aetna  Life  and  Casualty  Company  agreed  recently  on  new  procedures  to 
govern  payment  of  health  insurance  claims  for  persons  covered  at  work  by  group  plans. 
Aetna  agreed  to  drop  the  questions  from  its  claims  form  asking  about  factors  respon- 
sible for  the  illness,  the  type  of  impairment  in  the  patient's  family,  and  interper- 
sonal relations.     Only  the  medical  director  of  the  employer-company  would  be  given 
the  official  diagnosis  and  prognosis  of  the  patient  by  the  insurance  firm.    All  these 
records  would  be  destroyed  after  one  year.    Diagnosis  of  patients  who  were  not  vio- 
lent and  dangerous  to  others  would  not  be  made  known  to  the  employer  or  to  the  union; 
they  would  only  know  that  the  patient  was  being  reimbursed  for  medical  treatment.^ 

Model  legislation  is  now  under  discussion,  drafted  by  the  American  Hospital 
Association  and  the  American  Medical  Association,  that  would  affect  the  release  of 
information  by  primary  care  providers  to  third  parties.     This  would  obviously  affect 
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what  service  payers  could  lawfully  collect,  and  we  will  take  these  proposals  up  later 
in  this  chapter,  when  we  consider  model  legislation  as  a  whole. 

When  we  turn  to  quality  care  reviews,  the  collection  of  detailed  information 
about  diagnosis,  condition,  treatment,  outcome,  and  the  like  is  clearly  relevant, 
and  recording  such  information  for  the  care  review  process  has  become  an  important 
pressure  for  more  systematic  data  collection  in  primary  care  facilities  and  service 
payer  organizations.     The  key  issue  here  in  terms  of  the  principle  of  limited  data 
collection  is  whether  personal  identifiers  can  be  removed  from  the  records  reviewed 
in  this  process.     If  this  can  be  done,  it  would  reduce  substantially  the  threats 
that  sensitive  medical  data  about  celebrities  might  leak  out  of  the  care-review 
organizations,  or  that  information  about  political  opponents,  dissidents,  and  sur- 
veillance targets  might  be  obtained  by  high  government  officials  through  the  cooper- 
ation of  government  care-review  emloyees  or  by  penetration  of  the  record  system  by 
stealth.     Whether  this  can  be  done  will  be  a  particularly  critical  issue  in  securing 
public  support  for  any  proposed  national  health  insurance  plan,  where  the  problem  of 
a  federal  medical  record  system  on  most  citizens  raises  special,  post-Watergate  sen- 
sitivities . 

There  are  several  available  mechanisms  to  strip  names  ajid  other  unique  identi- 
fiers from  each  record  and  substitute  a  special  review  number.     This  can  be  done  by 
the  facility  holding  the  original  record,  as  with  hospitals  in  the  PAS  system  des- 
cribed in  Part  One.    if  it  is  necessary  in  certain  cases  to  bring  together  records 
on  the  same  individual  from  several  facilities  or  different  organizations,  a  special 
agency,  private  or  governmental,  could  be  given  the  job  of  combining  the  records  and 
forwarding  the  needed  information  with  only  a  review  code  number  as  the  identifier. 
If  attention  is  paid  to  removing  from  the  record  other  revealing  information  not 
really  needed  for  care  review  —  such  as  the  occupation  of  a  person  as  entertainer 
or  federal  executive  employee  —  there  should  be  few  reasonable  fears  about  identities 
breaking  through  records  even  though  names  are  not  on  them.     Should  situations  arise 
in  which  contact  with  the  patient  is  necessary  to  resolve  disputed  facts  or  issues, 
those  would  be  handled  as  exceptional  cases,  and  this  ought  not  to  be  cited  as  justi- 
fication for  having  identifiers  on  each  record  reviewed. 

Given  these  practical  procedures,  we  suggest  that  the  burden  of  proof  should  be 
on  each  quality-care  review  system  to  prove  that  it  cannot  operate  under  a  system 
without  unique  identifiers;  absent  such  a  showing,  it  should  be  the  duty  of  care 
review  organizations  to  devise  a  system  that  does  not  use  or  store  identified 
personal  records. 

C.  Social  uses  of  medical  and  health  data 

When  society  should  require  the  production  of  health  data  for  non-medical  uses 
has  come  under  serious  re-examination  in  the  past  decade.    We  saw  that  this  was  some- 
times a  matter  of  rethinking  the  relevance  of  physical  handicaps  or  emotional  and 
mental  status  for  decisions  about  employment,  licensing,  public  housing,  etc.  Some- 
times the  issue  was  how  relevant  past  health  conditions  might  be  for  making  present 
decisions  about  people,  especially  where  there  had  been  a  change  in  society's  atti- 
tude toward  a  once-stigmatized  condition  (e.g.,  abortion).     Still  another  issue  has 
been  how  to  deal  with  ^-ecording  the  health  data  of  minors,  with  special  problems  of 
minor-parental  relations  and  leakage  from  juvenile  care  into  the  larger  society. 
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The  employment  area  is  a  good  one  to  illustrate  the  application  of  the  relevancy 
principle.    V/e  noted  earlier  in  this  report  that  lawsuits  are  now  pending  which  chal- 
lenge the  right  of  government  and  private  employers  to  ask  for  general  information 
about  emotional  and  psychological  conditions  on  employment  applications.  Opposition 
to  "intrusive  medical  questions  by  employers"  has  been  registered  by  the  Privacy 

Committee  of  the  American  Civil  Liberties  Union,  which  has  prepared  a  policy  state- 
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ment  opposing  such  practices  for  adoption  by  the  ACLU  National  Board  of  Directors. 

Apart  from  government  licensing  requirements  that  include  health  tests  (airline 
pilots,  persons  working  in  food  establishments,  etc.),  most  employers  give  job  appli- 
cents  health  questionnaires  to  fill  out.     Some  employers  also  require  the  completion 
of  a  health  report  by  a  physician,  either  the  patient's  own  or  one  supplied  by  the 
employer.     The  typical  health  forms  ask  not  only  about  standard  diseases  and  health 
conditions  but  also  histories  of  past  conditions  (e.g.,  bedwetting)  and  about  past 
and  present  emotional  problems,  nervous  disorders,  and  related  pscychological  matters, 
including  whether  the  individual  is  presently  receiving  psychological  help. 

Employers  justify  these  inquiries  in  terms  of  securing  employees  who  will  be 
able  to  perform  satisfactorily  on  the  job,  will  be  likely  to  remain  long  enough  to 
justify  the  heavy  expenditures  for  training  and  promoting  employees,  and  to  keep  the 
employer's  group  health  premiums  (which  are  based  on  utilization  patterns)  as  low. as 
possible.     In  a  free  labor  market,  most  employers  would  assert^  selecting  healthy  em- 
ployees from  the  pools  of  job  applicants  is  a  legitimate  exercise  of  employer  choice, 
comparable  to  selecting  the  best  educated,  most  experienced,  and  best  performers  on 
aptitude  tests. 

As  with  many  areas  once  under  complete  employer  prerogative,  American  society 
i    has  imposed  substantial  limitations  on  employer  selection  policies  during  the  past 
decade,  in  both  governmental  and  private  employment.     If  educational  requirements  or 
tests  prove  to  have  the  effect  of  screening  out  minority  racial  applicants,  for 
example,  or  reducing  minority  employment  opportunities,  the  burden  is  placed  on  the 
employer  to  show  that  the  educational  requirements  or  tests  are  relevant  to  the  jobs 
involved,  and  that  they  do  not  incorporate  racial  biases.     Similarly,  even  physical 
requirements  for  jobs  (such  as  height  requirements)  cannot  be  used  against  minorities 
or  women  unless  they  can  be  shown  to  be  essential  to  the  performance  of  the  employ- 
ment, a  standard  that  the  courts  have  used  recently  to  strike  down  many  such  physical 
conditions.     In  addition,  federal  legislation  in  1973  on  the  employment  of  physically 
and  mentally  handicapped  persons  recognizes  an  obligation  by  employers  to  provide 
special  physical  facilities  that  may  be  needed  so  that  handicapped  persons  can  carry 
out  jobs,  thereby  wiping  out  the  excuse  that  many  employers  traditionally  used  to 
explain  why  they  could  not  hire  persons  in  wheelchairs,  using  crutches,  etc. 

In  part,  calls  to  reconsider  health  standards  for  employment  have  come  from 
practitioners  of  occupational  medicine,  who  regard  many  current  practices  of  cor- 
porations as  unwise.     A  study  by  two  Veterans  Administration  doctors  documented 
that  industrial  physicians  would  recommend  against  hiring  persons  with  conditions 
such  as  angina,  previous  myocardial  infarction,  diabetes,  hypertension,  and  previous 
psychiatric  illness,  with  the  reasons  cited  Including  fear  of  company  liability  for 
further  illness  and  increased  insurance  costs.     The  doctors  concluded  that  such 
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restrictive  policies  are  denying  work  to  "patients  with  mild  illnesses,  which  may 
not  increase  their  morbidity  or  mortality,"  and  that  the  criteria  used  "have  little 
relation  to  modern  medical  judgment."     Furthermore,  the  authors  voiced  the  concern 
that  "with  automation  of  hospital  records,  retrieval  of  medical  data  will  become 
easier,  and  it  may  be  impossible  for  an  applicant  to  conceal  a  past  or  present 
illness,  however  unimportant."     This  increase  in  record-keeping  trails  coincides 
with  a  trend  toward  discovering  diseases  "earlier  in  their  course  with  the  use  of 
newer  diagnostic  techniques,"  making  the  problem  of  employment  for  patients  who 

Q 

have  various  mild  illnesses  "even  more  widespread." 

Some  companies  have  altered  their  pre-employment  health  questionnaires  to  take 
account  of  citizen  rights  concerns.     The  IBM  corporation,  for  example,  used  to  re- 
quire applicants  for  employment  to  answer  a  question  about  receiving  prior  treatment 
for  a  nervous  disorder,  mental  problem,  or  emotional  difficulty.     A  privacy  review 
within  IBM  during  1974-75  showed  that  this  put  applicants  in  the  difficult  position 
of  answering  truthfully  (and  risking  a  turn-down)  or  lying  about  receiving  profes- 
sional help  for  emotional  problems  (and  starting  their  employment  relationship  with 
the  company  on  a  resentful  and  dishonest  note).     The  IBM  review  also  disclosed  that 
many  psychiatrists  were  counseling  their  patients  to  answer  "no"  to  such  pre-employ- 
ment queries  when  the  patient's  condition  did  not  indicate  any  inability  to  carry 
out  the  employment;  that  many  middle  class  parents  were  fearful  that  arranging 
therapy  for  their  children  could  lead  to  curtailment  of  their  future  employment 
opportunities;  and  that  there  was  no  medical  or  social  evidence  that  persons  who 
were  receiving  professional  help  for  emotional  problems  were  worse  employment  risks 
than  persons  of  similar  educational  and  social  backgrounds  who  were  not  receiving 
such  help.     After  weighing  these  problems  against  the  assumed  benefits  to  be  gained 

by  forcing  self-declarations  from  applicants ,  IBM  dropped  the  question  from  its 
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pre-employment  questionnaire  in  1975. 

Developing  new  standards  for  collecting  health  data  in  the  hiring  process  is  an 

example  of  a  priority  area  for  action  in  Zone  3  activity.     The  ACLU  Privacy  Committee 

suggests  that  "the  employer's  legitimate  interest  in  an  employee's  health  extends 

only  to  the  employee's  present  ability  satisfactorily  to  perform  the  job  sought," 

1  0 

and  "this  interest  must  be  satisfied  by  the  least  intrusive  means  available." 
An  employer  who  wishes  to  verify  that  ability  should  pay  for  a  medical  examination, 
with  the  employer  "entitled  only  to  the  physician's  certification  of  the  applicant's 
ability  or  inability  properly  to  perform  the  job  as  described  to  the  applicant  and 
the  examining  physician."     'Whether  done  by  the  applicant's  own  physician  or  a  company 
physician,  all  medical  information  obtained  by  such  an  examination  "shall  be  privi- 
leged and  confidential"  and  not  revealed  to  the  employer. 

This  recommended  policy  is  one  that  also  coincides  with  IBM  company  practice. 
While  less  than  2'/o  of  IBM  applicants  are  not  hired  for  medical  reasons,  Dr.  John  Duffy, 
IBM's  medical  director,  notes  that  5^°  of  its  employees  fall  within  U.S.  Bureau  of 
Labor  standards  of  handicapped  workers,  and  approximately  20%  of  IBM  employees  are 
subject  to  medical  restrictions  (e.g.,  controlled  diabetic).     When  applicants  are 
given  pre-employment  physicals  by  IBM  physicians  or  outside  consultants,  the  results 
are  kept  confidential,  and  IBM  managers  are  not  told  the  specific  health  reasons  if 
work  restrictions  are  set  by  the  company  medical  department  for  new  or  existing 
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employees.     An  employee's  health  condition  is  never  included  in  IBM's  personnel 
data  system. ^  ^ 

Our  discussion  of  collecting  health  data  on  job  applicants  illustrates  (as  we 
have  noted  before  in  this  report)  that  the  relevancy  and  propriety  issues  for  data 
systems  usually  raise  deeper  questions  of  social  policy.     There  is  no  necessity  that 
the  questions  be  raised  in  the  context  of  records  and  data  systems,  rather  than  more 
directly.     But  the  reality  is  that  this  is  often  the  way  that  affected  groups  and 
public-interest  organizations  can  bring  the  problem  to  public  attention.     Since  the 
building  of  new  data  systems  brings  these  policies  up  for  organizational  examination 
in  terms  of  data  collection  costs  and  efficiencies,  this  is  the  ideal  opportunity 
for  society  to  insure  that  proper  citizen  rights  policies  are  instituted. 

3 .  Notifying  Individuals  of  Data  Policies  When  Their  Information  Is  Sought 

Principle 

When  an  individual  is  asked  to  supply  personal  information  to  be  included  in  a 
health  data  system,  he  or  she  should  be  given  a  clearly-written  account  of  how  that 
information  will  be  used  by  the  collecting  organization,  and  what  procedures  for 
obtaining  consent  will  be  followed  before  any  additional  uses  will  be  made  within 
the  collecting  organization  or  identified  information  is  supplied  to  other  parties. 

Discussion 

Following  the  contract  or  mutuality  principle,  the  Federal  Privacy  Act  and  its 
state  counterparts  require  that  individuals  be  informed,  at  the  time  that  their  in- 
formation is  sought,  of  how  their  data  will  be  used  and  what  the  organization's  rules 
for  data  sharing  are.     Simple  and  equitable  as  this  sounds,  it  has  not  been  the  prac- 
tice among  many  health  organizations,  generally  on  the  assumptions  that  people  don't 
really  care  and  that  it  would  only  stir  up  unnecessary  anxieties.     Though  experience 
to  date  needs  to  be  systematically  canvassed  by  the  Privacy  Commission  and  other 
bodies,  the  impression  drawn  by  our  project  from  contacts  with  various  federal  health 
agencies  is  that  such  notification  has  been  going  fairly  well.     Agencies  have  included 
notices  on  their  data  collection  forms,  have  displayed  posters  in  their  offices,  and 
have  obtained  signed  acknowledgments  from  the  individuals  indicating  that  they  have 
been  informed  of  the  policies  and  give  their  information  after  being  so  informed. 

The  one  complaint  that  we  have  heard  involves  fears  that  an  organization  might 
want  to  use  personal  information  for  an  important  purpose  later  that  would  not  have 
been  described  and  assented  to  at  the  time  of  original  collection.     An  example  cited 
to  us  was  that  data  relating  to  the  effects  on  patients  of  using  a  particular  drug 
many  years  earlier  might  not  be  available  for  follow-up  research,  as  when  there  is 
some  reason  to  believe  that  a  birth-control  drug  used  ten  or  twenty  years  earlier 
might  now  be  producing  cancer  in  those  who  took  it.     To  ask  the  patients  for  consent 
to  use  their  later  data  in  the  hands  of  the  hospital  might  alarm  them  unnecessarily, 
before  the  possible  effects  have  been  confirmed. 

Rather  than  abandon  the  principle  of  describing  present  and  future  uses  at  the 
time  of  collection,  we  thixik  that  explanations  developed  by  various  kinds  of  health 
facilities  and  organizations  should  be  drawn  up  with  such  possible  contingencies  in 
mind.     It  does  not  seem  beyond  the  ingenuity  of  experts  in  medicine,  law,  and  admin- 
istration to  encompass  these  in  a  notice.     If  some  unforeseen  development  occurs 
later,  either  subsequent  consent  could  be  obtained  or  the  additional  use  might  be 
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authorized  by  an  independent  review  body  set  up  to  supervise  health  data  systems  in 
a  particular  field  and  insure  protection  of  citizen  rights.  Whatever  technique  may 
be  developed,  the  basic  point  is  that  citation  of  hypothetical  future  possibilities 
should  not  be  allowed  to  overcome  the  requirement  of  notice. 

4.  Information  Release  Forms  Should  Be  For  Specific  and  Limited  Purposes 

Principle 

Because  the  trend  in  automated  health  data  systems  is  to  record  and  retain 
personal  information  more  fully  and  systematically,  general  release  forms  do  not 
meet  proper  standards  of  citizen  rights.     The  forms  used  to  release  personal  infor- 
mation from  a  health  data  system  should  be  for  a  specific  purpose,  should  describe 
the  information  to  be  released,  and  should  be  limited  in  the  time  period  for  which 
the  release  applies.     Adequate  procedures  must  be  followed  to  obtain  the  individual's 
voluntary  and  informed  consent  to  any  release.     Provision  of  entire  medical  records 
under  release  procedures  should  be  permitted  only  upon  use  of  a  special  release  form, 
reviewed  by  a  special  officer  of  the  record-keeping  organization.  Organizations 
seeking  release  of  information  must  file  with  the  record  custodian  a  form  indicating 
how  they  would  use  the  data,  specifying  that  it  will  not  be  released  to  other  parties 
without  the  individual's  consent,  and  indicating  what  the  retention  or  destruction 
policies  are  for  the  information  so  obtained. 

Discussion 

The  general  release  in  the  health  field  brings  to  mind  the  general  warrants  to 
search  and  seize  used  by  British  officials  in  our  colonial  era,  against  which  the 
Founding  Fathers  fought  so  bitterly  and  which  they  forbade  by  the  Fourth  Amendment 
to  the  U.S.  Constitution.     Among  the  vices  of  the  general  warrant  were  that  it  au- 
thorized anyone  holding  it  to  engage  in  a  search;  did  not  indicate  the  purpose  and 
thereby  define  the  proper  scope  of  the  search;  and  did  not  specifically  describe  the 
things  to  be  searched  for  and  seized  if  found.     While  the  law  enforcement  and  health- 
care settings  are  very  different,  the  analogies  in  civil  liberties  theory  are,  alas, 
all  too  close. 

Individuals  are  being  asked  today  to  sign  releases  that  allow  the  custodian  of 
the  individual's  medical  record  to  disseminate  its  contents  however,  and  to  whomever, 
the  custodian  feels  necessary,  or  that  allovj  someone  who  is  offering  a  benefit  or 
service  to  the  individual  to  examine  "any  and  all"  medical  records  in  any  doctor's 
office  or  health  institution  to  which  the  inquiring  party  shows  up,  armed  with  the 
general  release.     The  absence  of  informed  consent  in  such  situations  is  proved  by 
the  fact  that  individuals  in  most  health  institutions  do  not  knew  (and  are  not  told) 
what  personal,  family,  social,  and  medical  information  is  in  the  records  that  will 
be  opened  for  inspection.     Even  if  they  do  know  generally  what  is  in  their  records, 
they  are  not  told  which  segments  of  this  the  insurer,  licensing  body,  employer, 
welfare  department,  etc.  will  have  access  to.     They  are  also  not  told  what  will  happen 
to  their  information  after  the  party  to  whom  it  is  released  has  made  its  decision 
(whether  it  will  be  destroyed,  passed  on  to  industry  data  pools,  stored  permanently 
by  the  third  party,  etc.). 

Such  practices,  bad  as  they  were  in  the  manual-records  era,  cannot  be  permitted 
to  persist  in  the  era  of  large-scale  health  data  systems,  with  increasingly  compre- 
hensive records  being  generated  and  preserved  in  primary  health  care  facilities  and 
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in  special  medical  files.    One  can  understand  the  motivations  of  the  health  providers 
in  seeking  the  broadest  possible  release  to  avoid  legal  liability  for  releasing  in- 
formation without  permission,  and  by  the  third-party  inquirers  in  seeking  access  to 
anything  that  might  prove  to  be  relevant  when  they  go  to  make  their  determination 
in  a  specific  inquiry.    But  allowing  such  motivations  to  justify  the  use  of  general, 
all-purpose  releases  is  to  allow  the  inferior  bargaining  position,  fears,  and  tempo- 
rary dependency  of  persons  receiving  health  care  to  be  legally  institutionalized, 
just  as  the  law  used  to  accept  similar  disadvantages  for  consumers,  debtors,  and  othe 
groups  in  unequal  bargaining  status  to  large  institutions.     Just  as  the  latter  abuses 
have  recently  been  overturned  by  legislation  and  court  rulings,  we  ought  to  overturn 
abuse  of  power  in  the  handling  of  information  releases. 

There  are  health  centers  and  hospitals  which  take  exemplary  positions  in  this 
matter.    We  saw  in  the  profile  how  the  Martin  Luther  King  Jr.  Health  Center  required 
patient  consent  to  the  release  of  information.    Here  is  the  recommended  policy  for 

neighborhood  health  centers,  as  presented  in  an  excellent  guidebook  on  confiden- 

1  2 

tiality  published  under  OEO  auspices  in  1971 : 


Release  of  Information  with  Informed  Consent 

The  health  center  should  not  divulge  confidential  patient  infor- 
mation contained  in  patient  records  without  obtaining  a  signed  release 
from  the  patient,  unless  (1)  there  are  statutes  to  the  contrary,  or 
(2)  there  is  a  serious  emergency  requiring  release  without  consent.  Does 
this  mean  that  the  health  center  must  release  patient  information 
whenever  it  receives  a  signed  patient  authorization?  The  answer 
depends  largely  on  the  statutory  and  case  law  of  the  state.  In  general, 
consent  is  not  considered  valid  unless  it  is  informed  consent,  i.e.,  the 
patient  fully  understands  what  he  is  consenting  to.  Even  in  states  where 
the  law  requires  release  when  patients  have  signed  consent  forms,  health 
institutions  must  take  precautions  to  protect  the  patient.  The  medical 
record  librarian  should  take  the  five  steps  described  in  detail  below. 

Require  the  patient's  signed  consent. 

The  patient  may  write  his  own  letter  of  consent  or  sign  a  standard 
form,  such  as  a  health  insurance  poUcy  form.  If  the  patient  writes  his 
own  consent  statement,  he  should  state  specifically  to  whom  the 
information  is  to  be  released  and  exactly  what  information  is  to  be 
"jeleased,  and  he  should  sign  and  date  the  request.  The  Ubrarian  should 
check  the  patient's  signature  against  a  previously  obtained  signature, 
and  note  the  date  to  be  sure  that  the  request  is  current.  It  is  advisable 
to  set  a  maximum  length  of  time,  such  as  90  days,  after  which  the 
request  is  no  longer  considered  current  and  will  not  be  honored.  If 
there  is  reason  to  believe  that  the  authorization  is  not  genuine,  or  if  it  is 
not  current,  the  medical  record  Ubrarian  should  withhold  the  informa- 
tion until  she  has  received  a  vahd,  current  authorization  from  the 
patient.  One  way  of  determining  whether  the  request  is  genuine  is  to 
contact  the  patient  by  phone. 

Patient  consent  for  release  of  information  should  not  extend 
beyond  a  specific  illness  or  its  subsequent  treatment.  If  an  authoriza- 
tion carries  a  date  which  is  prior  to  the  date  of  the  requested  informa- 
tion, the  medical  record  librarian  should  determine  if  the  authorization 
appUes  to  the  specific  illness  for  which  information  was  requested.  If 
the  authorization  pertains  to  a  different  illness  or  treatment,  a  new 
consent  form  should  be  obtained.  Each  health  center  should  have  its 
standard  consent  forms  reviewed  by  an  attorney  to  make  certain  that 
the  forms  adequately  protect  the  patient  and  the  institution. 
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Establish  that  the  patient  understands  what  information 
is  being  released  and  to  whom  it  is  being  released. 

This  is  important  to  ensure  informed  consent.  It  will  not  be 
feasible  to  check  with  the  patient  in  every  case,  but  it  is  important  to 
contact  the  patient  if  there  is  reason  to  doubt  that  his  consent  is  truly 
inlormed. 

Because  of  the  pressure  that  is  often  exerted  on  people  to  sign 
printed  forms,  center  staff  members  may  wish  to  educate  all  patients 
about  the  consequences  of  signing  various  kinds  of  forms. 

Send  out  only  that  information  from  the 
patient 's  record  which  is  specifically  requested. 

For  example,  the  health  center  should  withhold  psychiatric  and 
social  information  unless  it  is  specifically  requested.  If  an  insurance 
company  or  the  State  Industrial  Accident  Commission  seeks  informa- 
tion regarding  a  particular  accident,  the  health  center  should  withhold 
information  recorded  before  the  date  of  the  accident  unless  the  infor- 
mation is  included  within  the  scope  of  both  the  request  and  patient's 
consent. 

Inform  the  patient's  physician  or  the  appropriate 
team  member  that  information  is  being  released. 

If  the  record  contains  particularly  sensitive  data,  consult  with  the 
physician  before  releasing  any  information. 

Be  reasonably  certain  that  the  institution 

or  individual  to  whom  the  information  is  being 

released  will  keep  it  confidential. 

It  may  be  impossible  to  receive  a  guarantee  of  continued  confi- 
dentiahty  in  every  case,  but  the  health  center  may  wish  to  consider 
requiring  such  a  guarantee,  in  writing,  from  any  institution  or  individual 
that  receives  a  great  deal  of  patient  information  and  from  any  institu- 
tion or  individual  whose  willingness  or  ability  to  guard  the  confiden- 
tiahty  of  patient  information  is  in  question. 

Health  care  providers  from  different  agencies  may  legitimately 
communicate  verbally  about  a  patient  without  written  consent  when 
they  are  cooperating  in  the  care  of  the  patient.  For  example,  when  an 
elderly  person  is  being  cared  for  by  a  pubUc  health  nurse  from  another 
agency  as  well  as  by  a  family  health  worker  from  a  neighborhood  health 
center,  many  informal  communications  between  the  providers  are  legiti- 
mate and  necessary  and  do  not  require  written  consent.  However, 
health  center  staff  members  should  make  certain  that  they  have  the 
patient's  understanding  and  verbal  consent,  in  order  to  avoid  invading 
his  privacy  or  making  communications  that  the  patient  himself  would 
not  make. 


While  this  illustrates  the  kind  of  sensitive  policy  that  some  neighborhood 
health  centers  are  already  using,  largely  for  manual  record  systems,  we  think 
that  more  detailed  and  protective  policies  can  and  should  be  used  in  health  data 
systems.     These  involve  specification  to  the  individual  in  written  form  of  the 
organization  or  persons  who  will  obtain  the  data,  the  purpose  for  which  the  infor- 
mation is  sought,  the  specific  data  that  would  be  supplied,  what  will  be  done  with 
it  once  the  stated  purpose  is  completed,  and  what  promises  the  party  obtaining  the 
data  makes  as  to  its  safe  and  secure  treatment.     Such  releases  should  only  be  for 
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a  limited  time  period  (such  as  30  or  60  days).     The  consequences  to  the  individual 
that  might  occur  if  the  information  is  supplied  —  or  not  supplied  —  should  be 
clearly  explained,  so  that  he  or  she  could  decide  whether  to  reveal  or  withhold  the 
information.     (The  Georgia  mental  health  center  study  we  discussed  earlier  in  this 
report  indicated  that  many  persons  receiving  medical  services  would  not  consent  to 
disclosure  of  their  records  to  state  health  authorities  if  they  could  be  assured  that 
this  would  not  jeopardize  their  continuing  to  receive  medical  assistance.)  Release 
forms  should  be  revocable  by  the  individual  within  a  specified  time,  and  this  right 
should  be  fully  explained,  including,  of  course,  the  potentially  harmful  consequences 
to  the  individual  of  such  revocation. 

One  interesting  proposal  made  by  Dr.  Simon  Auster,  a  Virginia  psychiatrist  and 
expert  on  citizen  rights  issues  in  health  care,  is  to  give  the  patient  in  any  health 
care  setting  an  advance  copy  of  the  information  that  is  to  be  released.     The  statutory 
language  he  proposed  would  be  as  follows 

"No  information  identifiable  to  the  patient  shall  be  released  by 
the  hospital,  facility,  agency  or  physician  without  the  patient's  ex- 
press permission,  except  (1)  as  may  be  ordered  by  a  Court  of  Record, 
in  which  case,  the  patient  must  be  given  prior  notice  of  such  order 
and  may  contest  it  in  the  customary  manner,  or  (2)  where  the  patient 
has  a  communicable  disease,  the  reporting  of  which  is  required  by  law, 
in  which  case  the  patient  must  be  informed  that  the  report  is  being 
made . " 

*      ♦  •«■ 

"The  patient  may  request,  and  will  be  provided  with  copies  of 
any  other  information  the  hospital,  facility,  agency  or  physician 
proposes  to  release  to  any  other  parties  authorized  by  the  patient 
to  receive  it.     The  patient  may  rescind  his  authorization  to  release 
the  information  within  two  weeks  after  receiving  his  copy.     No  hospi- 
tal, facility,  agency  or  physician  shall  release  any  Information  about 
a  patient  on  the  basis  of  a  blanket  authorization  without  first  obtain- 
ing specific  authorization  from  the  patient.     At  the  time  the  patient 
is  requested  to  authorize  the  release  of  information,  he  shall  be  in- 
formed of  his  right  to  receive  a  copy  of  the  information  in  advance, 
and  of  his  right  to  rescind  the  authorization  within  the  prescribed 
period  if  he  wishes." 


An  important  aspect  of  Dr.  Auster 's  proposal  is  that  it  brings  the  element 
of  patient  notification  to  bear  even  when  statutory  law  may  require  the  reporting 
of  communicable  disease  (and  the  patient  cannot  prevent  the  reporting).  In 
fact,  as  we  saw  in  Part  One,  current  statutes  require  the  reporting  of  many 
more  conditions  than  communicable  disease,  such  as  gunshot  wounds  or  child- 
abuse  injuries.    Presumably,  legislatures  considering  new  medical  confidentiality 
codes  would  decide  which  existing  reporting  duties  should  be  retained,  and 
could  apply  the  patient  notification  principle  to  those  areas  as  well. 
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5.  Increasing  Patient  Access  Rights  to  Their  Own  Medical  Information 
Principle 

Individuals  should  have  a  general  right  to  information  about  their  health 
condition,  treatment,  and  prognosis,  as  a  matter  of  fulfilling  the  professional's 
fiduciary  duty  and  protecting  the  patient's  ultimate  primacy  in  choosing  his/her  own 
health  destiny.     In  health  data  systems,  an  individual  should  have  an  absolute  right 
to  inspect  any  recorded  data  about  him  or  her  that  is  used  to  make  judgments  about 
eligibility  for  health  programs  and  coverages,  claims  payment,  or  other  aspects  of 
service  administration.     The  same  absolute  right  of  access  should  be  provided  when 
health  data  are  disseminated  to  determine  rights,  benefits,  or  opportunities  outside 
primary  care  settings,  as  in  insurance,  employment,  licensing,  education,  welfare, 
etc.    A  procedure  should  be  provided  for  explaining  medical  terminology  where  this 
is  necessary,  and  for  allowing  the  individual  to  challenge  the  accuracy  or 
completeness  of  the  recorded  data. 

Where  that  part  of  the  medical  record  is  involved  in  which  the  health 
professional's  working  notes  or  other  speculative,  informal  recordings  are  present, 
or  where  they  are  sensitive  judgments  about  the  patient's  emotional  condition  that 
might  unduly  upset  the  patient  to  see,  ajid  these  materials  are  used  solely  within 
the  primary-care  facility,  a  procedure  should  be  afforded  that  gives  the  physician 
an  opportunity  to  explain  to  the  patient  why  access  would  not  be  desirable,  or  to 
suggest  disclosure  to  another  physician  of  the  patient's  choice?  but  if  the  patient 
is  not  persuaded  by  these  counsels,  a  right  of  access  should  be  provided  to  patients 
in  either  chronic  guid  acute  care.     Where  psychiatric  ceire  is  involved,  disclosure 
of  the  record  directly  to  the  patient  over  the  advice  of  the  psychiatrist  would 
require  an  order  from  a  civil  court. 

Discussion 

Whether  an  individual  should  have  a  right  of  access  to  his/her  medical  record 
in  a  health  data  system  raises  the  most  complex  and  controversial  issue  of  this  study. 
We  found  thoughtful  and  ethical  positions  on  both  main  sides  of  the  debate,  ajid 
there  are  vexing  complications  in  all  the  reform  proposals  that  have  been  advocated.  For 
these  reasons,  our  discussion  of  access  will  be  more  extensive  than  with  any  other 
principle  presented,  and  we  will  first  summarize  the  existing  state  of  policy 
conflict  and  law  to  have  this  at  hand  for  our  analysis. 

Underlying  the  basic  access  debate  are  two  competing  models  of  how  information 
should  be  controlled  in  the  doctor-patient  relationship.     The  traditional  model, 
still  dominant  in  the  medical  profession  and  among  health  administrators,  is  the 
"doctor's  judgment"  approach.     It  assumes  that  the  expert,  ethically-bound  physician 
ought  to  decide  what  information  is  made  available  to  the  patient,  based  on  the 
professional's  judgment  of  what  will  be  in  the  patient's  best  interest.     This  model 
rejects  ajiy  notion  of  a  patient's  right  to  "full"  information  for  several  reasons: 
complete  disclosure  might  create  needless  anxiety  or  upset  a  patient  unduly;  telling 
only  part  of  the  truth,  or  withholding  information  temporgirily ,  may  be  good  medicine 
in  a  particular  situation,  especially  where  psychosomatic  aspects  are  involved; 
patients  would  not  be  helped  if  they  were  to  be  told  the  speculative  and  tentative 
hypotheses  that  physicians  were  considering  at  a  given  moment;  and,  especially  in 
psychiatry,  the  patient  may  be  so  emotionally  incapable  of  handling  truthful 
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information  that  its  disclosure  would  be  positively  harmful.     A  good  doctor,  it  is 
said,  should  disclose  every  bit  of  information  that  will  advajice  good  cgire,  but  this 
must  ultimately  be  the  doctor's  decision,  and  one  not  subject  to  delegation  to  any 
other  authority. 

The  more  recent  model  of  information  control  rests  on  a  "consumer"  theory  of 
health  care.     It  sees  the  physician  as  an  agent  of  the  patient,  hired  to  exercise 
his/her  professional  skills  and  judgment  but  also  bound  by  a  fiduciary  duty  to  make 
full  disclosure  to  the  patient  if  and  when  this  is  demanded.     Such  a  right  to  full 
information  is  seen  as  important  for  the  following  reasons:     it  is  essential  to  the 
patient  in  making  informed  decisions  about  the  risks  aind  benefits  of  proposed 
treatments  and  operations;  it  is  essential  if  the  patient  is  to  know  whether  to 
authorize  release  of  his/her  medical  information  to  third  parties;  it  fosters  patient 
participation  in  and  taking  responsibility  for  his/her  own  health  care;  it  would 
assist  patients  in  making  consumer  judgments  about  the  acceptability  of  care  being 
provided  by  a  given  doctor  or  hospital,  compared  to  other  available  alternatives; 
and  that  while  some  patients  may  be  so  emotionally  distraught  that  they  cannot  handle 
full  information,  those  adult  patients  who  ask  for  full  disclosure  of  their  condition 
and  prospects  should  not  be  denied  it,  including  those  situations  of  terminal  illness 
where  a  particular  patient  wants  to  be  able  to  decide  how  to  use  the  remaining  period 
of  life. 

At  present,  American  case  law  does  not  clearly  resolve  the  conflict  between 
these  two  theories,  and  each  can  point  to  some  decisions  advancing  its  position.  In 
support  of  the  consumer  notion,  the  courts  have  held  that  a  doctor  must  inform  the 
patient  of  all  the  risks  and  potential  outcomes  of  any  dangerous  procedure,  and  to 
withhold  anything  that  might  be  relevant  to  the  patient's  decision  constitutes  a 
failure  of  duty.     On  the  other  hand,  in  ordinary  care,  the  courts  have  upheld  the 
doctor's  right  to  deQide  what  information  to  disclose  to  the  patient  ajid  his  family, 
as  a  matter  of  professional  judgment  of  the  patient's  best  interests. 

When  the  disclosure  issue  shifts  to  the  question  of  access  to  medical  records . 
several  additional  arguments  are  added  to  the  basic  positions  held  by  each  model. 
In  behalf  of  the  consumer  position,  it  is  argued  thatt  medical  records  today, 
especially  in  group  practices  and  hospitals,  are  compiled  by  a  variety  of  health 
professionals  and  used  by  various  persons  giving  ceire,  making  it  essential  that  a 
patient  who  feels  that  mistaken  or  erroneous  data  has  gotten  into  the  record  should 
be  able  to  see  and  correct  it  before  care  decisions  are  made  in  reliance  on  wrong 
data;  examining  what  is  recorded  is  the  only  way  patients  can  decide  intelligently 
whether  to  release  some  or  all  of  it  for  service  payment  or  social-use  purposes; 
providing  access  would  lessen  the  need. of  patients  to  file  malpractice  suits  just  to 
see  what  was  in  the  record;  and  showing  patients  their  records  on  a  regular  basis 
would  improve  patient  confidence  in  care  and  enhance  patient  cooperation  in  treatment. 
If  the  records  today  are  not  written  in  language  that  would  be  intelligible  to 
patients,  the  consumer  position  contends  that  explanations  should  either  be  added  to 
the  record  or  made  to  the  patient  orally  by  health  professionals. 

The  doctor's  judgment  model,  in  opposing  a  right  of  access  to  records,  responds 
along  the  following  lines.     Medical  records  are  generally  written  in  technical  and 
jargonistic  terras  that  communicate  to  fellow  professionals  but  that  patients  would 
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not  understand,  and  having  to  explain  these  constemtly  to  patients  would  be  an 
unnecessarily  time-consuming  and  expensive  procedure;  having  to  write  notes  and 
observations  constantly  in  a  way  that  would  be  diplomatic  when  read  by  the  patient 
would  impair    the  directness  and  clarity  of  present  record-keeping j  providing  access 
would  inhibit  doctors  from  putting  down  the  speculative  and  hypothetical  comments 
they  now    do,  to  help  both  themselves  and  other  professionals  who  may  later  consult 
the  record,  and  would  lead  to  highly  defensive  re cord -keeping  practices;  and  all  the 
above  pressures  would  make  medical  records  much  less  valuable  in  the  future  for 
service  payment , medical  research,  care-review,  and  similar  uses. 

As  with  the  right  to  information,  existing  law  on  access  to  records  can  only  be 
called  inconclusive.    In  the  great  majority  of  states,  there  is  no  legislative  or 
judicially-declared  right  of  general  access  by  patients  to  their  own  records  when 
these  are  in  the  doctor's  office  or  hospital,  though  the  law  recognizes  the  patient's 
right  to  have  the  records  sent  to  a  new  doctor  or  hospital,  or  to  have  the  physician 
furnish  record  data  for  care  payment  purposes.    While  only  a  few  states  have  enacted 
a  general  right  of  access  statute,  any  patient  who  files  a  malpractice  action  is  able 
to  secure  the  entire  medical  record  for  the  purposes  of  the  litigation.  Federal 
agencies  providing  health-care,  such  as  the  Indian  Health  Service  or  Veterans' 
Administration  hospitals,  are  now  governed  by  the  Federal  Privacy  Act  of  197^ >  which 
sets  a  general  right  of  access  by  individuals  to  their  federal  records,  with  no 
exemption  in  the  statute  for  medical  records.    However,  regulations  issued  by  federal 
health-care  agencies  have  specified  that,  if  the  federal  physician  feels  it  is  called 
for,  disclosure  of  the  patient's  record  can  be  limited  to  an  outside  physicisui 
selected  by  the  patient,  who  would  then  decide  what  to  disclose  to  the  individual. 

While   the  two  basic  models  are  usually  advocated  for  every  type  of  health 

setting,  some  commentators  suggest  that  society's  response  might  well  apply  different 
rules  depending  on  what  kind  of  care  is  involved.    For  example,  the  majiagement  of 
chronic  illness  and  rehabilitative  medicine  in  clinics  and  doctor's  offices,  with  a 
focus  on  continuing-care  relationships  over  substantial  periods  of  time  and  the  need 
for  patients  to  cooperate  actively  in  health  regimens,  has  been  seen  as  the  most 
favorable  setting  for  a  patient  right  of  access.    On  the  other  hand,  psychiatric 
care  has  been  described  as  the  least  favorable,  since  it  is  assumed  that  so  many 
patients  in  private  or  institutional  care  are  likely  to  be  harmed  by  a  policy  of 
automatic  disclosure.    This  leaves  acute  care — the  typical  hospital  situation— as 
middle  ground. 

Having  summaurized  the  arguments  for  ajid  against  access  rights,  one  last  point 
of  background  is  useful.     On  the  whole,  automation  of  patient  histories  and  medical- 
record  applications  both  accentuates  the  problem  for  both  sides  and  offers  some 
interesting  possibilities  for  working  out  practical  solutions. 

Computerization  accentuates  because(as  we  noted)  it  leads  to  richer  and  more 
complete  patient  records.     This  makes  patients  more  concerned  about  what  is  now 
captured  in  their  records  and  disseminated  efficiently  beyond  the  primary  care 
setting,  and  makes  doctors  more  worried  about  having  their  detailed  progress  notes, 
formal  diagnoses,  and  observations  on  emotional  and  social  aspects  printed  out  for 
patients  to  take  away,  and  often  to  show  to  their  lawyers  and  friends.     At  the  same 
time,  compared  to  the  handling  of  manual  or  microfilmed  records,  the  computer  makes 
it  much  easier  to  print  only  selective  portions  of  a  record,  under  rules  of 
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authorization,  and  to  suppress  securely  all  parts  of  a  record  that  are  not  to  be 
displayed  or  printed  to  a  given  inquirer — patient,  insurance  company,  researcher, 
policeman,  etc. 

Recognizing  the  persuasive  aspects  in  each  basic  view  of  disclosure  and  good 
health  care,  policy  choices  still  must  be  made.     The  ones  we  recommend  move  toward 
increasing  patient  rights  of  access.     Two  central  considerations  help  us  to  reach 
this  judgment.     First  of  all,  for  most  Americans  today,  health  care  is  simply  no 
longer  the  one -on-one,  family -physician  situation  in  a  Dr.  Kildare  £ind  Marcus  Welby 
type  of  personal  medicine,  where  the  individual's  personal  and  emotional  life,  job 
problems,  and  family  relations  are  intimately  known,  over  long  periods  of  time,  by 
a  single  physician  or  small  group  practice.    For  the  majority  of  Americans,  care  by 
a  succession  of  doctors  and  nurses  in  group  practices,  clinics,  axid  hospitals  is  the 
rule.     Given  the  mobility  of  Americans  for  schooling,  occupation,  and  residence, 
changes  in  such  physicians  and  institutions  are  frequent.    And  even  those  patients 
who  have  access  to  one  regular,  general  practitioner  will  be  treated  by  a  series  of 
specialists  and  institutions  for  particular  problems.     In  this  setting,  it  makes  no 
sense  to  install  a  national  legal  rule  as  to  patient  access  that  is  geared  to  a 
treatment  situation  of  sustained  personal  relationships  that  covers  only  a  small 
minority  of  the  patient  population. 

Secondly,  we  are  entering  a  period  of  change  in  the  format  and  content  of 
medical  records,  spurred  not  only  by  dissatisfaction  within  the  medical  profession 
that  has  prompted  problem-oriented  record  reforms,  but  also  the  tremendous  pressures 
to  redesign  records  in  order  to  meet  increasingly  strict  payment  and  care-review 
requirements.     This  condition  of  change  being  the  case — and  with  the  information- 
handling  capabilities  of  the  computer  to  draw  upon  for  innovative  solutions — 
American  society  ought  not  to  allow  the  present  character  of  medical  records  to 
control  the  decision  as  to  what  would  be  the  best  access  policy  for  the  future, 
especially  for  automated  health  data  systems. 

For  these  reasons,  we  suggest  that  health  data  systems  should  move  toward  a 
two-tier  or  "dual"  system  of  medical  records.     The  first  part,  which  would  come 
to  be  considered  the  official  record,  would  consist  of  all  personal  data  about  the 
patient;  social  and  family  history;  complaints,  tests,  and  examination  results; 
diagnoses  recorded;  treatment  summaries,  drug  regimens,  etc.;  payment  information; 
and  any  other  sets  of  data  that  were  to  be  recorded  as  official.     The  patient  would 
have  a  full  right  of  access  to  this  part  of  the  record,  with  a  procedure  to  explain 
medical  terminology  or  the  implications  of  diagnoses. 

The  second  part  of  the  record  would  consist  of  any  especially  sensitive  judgments 
about  a  patient's  emotional  or  psychological  condition  or  speculative  and  tentative 
hypotheses  that  a  health  professional  wanted  preserved  for  his/her  own  use,  or  that 
of  others  sharing  in  direct,  primary  care.    Such  materials  would  not  be  available 
for  any  other  uses  beyond  primary  case.     It  would  be  reachable  through  subpoena  by 
the  patient  in  a  malpractice  case,   just  as  such  physician's  notes  are  now.  Obviously, 
then  as  now,  anything  a  physician  did  not  think  it  safe  or  wise  to  write  down  would 
not  become  part  of  any  record,  a  prospect  that  would  at  least  prevent  the  circulation 
of  such  data  to  third  parties  • 
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The  idea  of  dual  record-keeping  has  been  endorsed  recently  by  an  interestingly 
varied  set  of  commentators,  such  as  the  American  Society  of  Internal  Medicine,  the 
American  Civil  Liberties  Union,  and  the  IBM  Medical  Department.        The  concept  rests 
on  preserving  the  confidentiality  of  especially  sensitive  professional  commentary 
within  primary  care  while  recognizing  that  the  patient's  interests  in  protecting 
his/her  rights  in  service  payment  and  social  uses  of  medical  data  must  be  insured. 

We  recommend  that  different  procedures  for  patient  access  to  the  second  part  of 
the  dual  record  be  followed  for  chronic  and  acute  care  on  the  one  hand,  eind 
psychiatric  caire  on  the  other  hand.    For  chronic  and  acute  care,  those  physicians  or 
institutions  that  wish  to  do  so  ought  to  be  encouraged  to  experiment  with  regularly 
giving  patients  copies  of  their  entire  problem-oriented  record,  as  is  being  done  with 
considerable  benefit  in  several  hospitals  already. Where  this  is  not  the  policy 
followed  voluntarily,  a  three  step  process  should  be  required! 

1.  The  health  professional  supervising  the  patient  should  have  an  opportunity 
to  discuss  with  the  patient  directly  why  the  professional  feels  access  to  the  second 
part  of  the  record  would  be  medically  or  psychologically  unwise. 

2.  If  the  patient  is  not  persuaded,  the  health  professional  should  be  able  to 
recommend  that  disclosure  be  made  to  another  physiciaji  of  the  patient's  choice,  who 
could  then  decide  what  to  reveal  to  the  patient. 

3.  If  the  patient  rejects  both  these  options,  the  patient  should  have  the  right 
to  see  the  record.    Essentially  this  is  on  the  theory  that  there  has  already  been  a 
collapse  of  trust  in  the  doctor-patient  relationship  and  it  would  not  be  good 
medicine  or  in  the  patient's  best  interest  to  continue  to  refuse  access  at  that 
point. 

Psychiatric  care  raises  special  problems,  since  many  patients  in  therapy — though 
by  no  means  all — may  be  so  emotionally  disturbed  that  they  could  not  "handle"  such 
information  from  the  second  peirt  of  a  record  as  diagnostic  terms,  observations  on 
their  personal  histories,  etc.    Where  there  is  individual  psychiatric  care  in  a 
one-to-one  relationship,  non-institutionalized,  we  recommend  the  same  first  two 
steps  described  above  but  a  different  third  step.     If  the  patient  still  wishes  to 
have  access  to  the  record  after  the  psychiatrist  attempts  to  dissuade  him/her,  the 
record  would  be  provided  unless  the  psychiatrist  felt  withholding  it  would  be  so 
important  to  the  patient's  well-being  that  the  psychiatrist  is  willing  to  end  the 
therapist-  patient  relationship.    If  such  is  the  case,  the  record  could  be  withheld 
unless  the  individual  applied  to  a  civil  court  to  have  the  record  disclosed.  The 
court  would  hear  in  chambers  the  arguments  of  the  health  professional  and  the  patient 
and  then  decide  whether  direct  disclosure  was  to  be  ordered. 

Where  individuals  are  institutionalized,  the  need  to  protect  their  rights 
against  abuse,  especially  in  state  mental  facilities  that  may  be  providing  inadequate 
care,  makes  a  third-step  court  proceeding  brought  by  the  individual  or  his/her  legal 
guardian  the  desirable  procedure.     This  is  essentially  what  the  court  did  in  granting 
parents  of  retarded  children  at  Willowbrook  in  New  York  a  continuing  right  of  access 
to  the  medical  records,,  as  part  of  a  suit  brought  against  the  institution      to  insure 
adequate  care . ^  ^ 
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As  we  suggested  earlier  in  this  discussion,  the  computer  makes  it  quite  feasible 
to  store  all  the  data  about  a  patient  in  one  file  that  has  different  access  codes  to 
control  display  and  print-out  of  two  different  segments  or  even  to  store  the 
sensitive  second  part  of  a  medical  record  on  a  minicomputer  apart  from  the  main 
patient  files.    Audit  trails  can  be  established  to  document  who  uses  the  "internal" 
segment,  and  a  general  inspection  and  testing  of  the  dual  record  system  would  be  made 
periodically  by  the  reviewing  authority  we  have  already  proposed  . 

There  is  little  doubt  in  our  minds  that  the  suggestion  for  a  dual  record  system 
and  giving  patients  access  rights  will  be  vigorously  rejected  by  many  medical 
practitioners  ajid  health  administrators  today.     It  may  be  that  it  will  take  years  of 
experience  with  Federal  Privacy  Act  access  procedures,  with  further  voluntary  projects 
such  as  those  being  conducted  by  Dr.  Lawrence  Weed,  Dr.  Arnold  Golodetz,  and  others j 
and  with  corporate  programs  such  as  that  of  IBM  before  a  majority  of  the  medical 
profession  would  be  willing  to  accept  these  ideas  with  enthusiasm.    Some  persons  such 
as  Dr.  Golodetz  suggest  waiting  out  that  period,  ajid  counting  on  example  and 
advocacy  to  persuade.   '     But  this  assumes  that  we  have  a  good  deal  of  lead  time,  an 
assumption  that  must  be  examined  in  terms  of  when  a  national  health  insurance  plan 
might  be  enacted,  major  expansions  of  health  data  systems  might  go  forward  in 
hospitals,  and  major  regional  data  systems  might  be  developed.     When  such  major  steps 
are  taken,  we  suggest  that  the  line  has  been  crossed  at  which  the  intervention  of 
law  ought  to  take  place,  at  least  for  the  records  in  those  health  data  systems. 
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6 .  The  Duty  to  Insare  Appropriate  Accuracy 
Principle 

The  managers  and  staff  of  a  health  data  system  must  take  steps  to  see  that  the 
personal  data  they  store  are  as  accurate,  timely,  and  complete  as  the  uses  to  be 
made  of  them  require,  not  only  to  assure  the  individual's  proper  health  care  but 
also  to  protect  the  social  opportunities  and  benefits  of  individuals  that  may  be 
determined  through  use  of  such  data.     Participation  of  the  individual  in  review  of 
his/her  records  before  release  to  third  parties,  and  affording  individuals  a  general 
right  of  access  to  their  records,  represent  helpful  ways  to  improve  accuracy  in  such 
data  systems. 

Discussion 

Throughout  our  project,  in  studying  the  literature  and  making  our  site  visits, 
we  saw  that  errors  of  personal  information,  faulty  recording  of  test  results  and 
diagnoses,  and  failure  to  complete  necessary  record  items  were  persistent  problems 
of  record-keeping  in  hospitals  and  doctors'  offices.     When  records  are  automated, 
their  use  by  many  members  of  a  health  team,  or  their  circulation  throughout  a 
multi-unit  facility  or  regional  health  organization,  or  reliance  on  them  for 
producing  payment,  claims,  and  social-use  data  all  make  it  important  to  assure 
the  accuracy  of  individual  records. 

When  an  automated  system  is  properly  designed  and  administered,  it  can  increase 
traditional  accuracy  levels.     For  example,  we  saw  automated  systems  in  which  failure 
by  health  professionals  to  supply  the  information  called  for  in  reports  would  produce 
"tickler"  notices  to  the  professionals  that  such  omissions  had  occurred,  as  well  as 
notices  to  data  processing  staff  or  administrators  to  take  follow-up  action  if  the 
data  were  not  furnished  within  a  certain  time.     Orientation  and  training  sessions 
also  helped  increase  the  commitment  to  supply  required  data.     Tests  for  the  internal 
consistency  of  data  in  a  record  can  be  written  into  software  programs,  thereby 
catching  some  mistakes  that  would  have  gone  unnoticed  in  a  file  of  paper  sheets. 

We  also  saw  that  accuracy  was  improved  when  patients  undergoing  automated 
multi-phasic  testing  in  hospitals  or  corporate  screening  programs  were  given  a 
printout  of  their  personal  data,  histories,  and  previous  test  results,  and  would 
correct  inaccuracies  that  they  noticed.     The  same  improvement  in  record  accuracy 
and  completeness  took  place  with  the  use  of  automated  problem-oriented  records  given 
to  patients  in  Dr.  Weed's  center,  and  with  the  admission  plan  and  discharge  summary 
provided  to  patients  in  the  Vermont  rehabilitation  center  project  described  by 
Dr.  &olodetz.     Greater  use  of  such  patient  reviews  in  primary  care  or  of  subscriber 
reviews  in  health  insurance  would  certainly  lead  to  a  higher  level  of  accuracy  in 
records . 

Whether  or  not  patient  access  is  afforded,  managers  of  health  data  systems 
must  take  effective  steps  to  see  that  records  are  accurate,  timely,  and  complete. 
What  these  standards  mean  in  a  given  data  system  will  have  to  depend  on  how  the 
records  are  being  used.     For  primary  care,  reliance  on  the  result  of  an  outdated 
lab  test  instead  of  doing  a  new  one  before  making  a  medical  decision  or  going  ahead 
with  a  drug  dosage  or  operation  would  obviously  be  unacceptable.     Similarly,  accept- 
ing a  recorded  diagnosis  that  came  from  a  source  or  a  situation  that  was  less  than 
completely  reliable  (a  school  nurse's  comment  that  a  child's  fit  looked  like 
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epilepsy)  would  be  an  equally  poor  reliance  on  "the  record." 

The  basic  point  is  that  the  more  comprehensive  a  health  data  system,  and  the 
more  its  records  are  relied  on,  the  greater  the  attention  that  must  be  paid  to 
accuracy,  with  a  resulting  commitment  of  personnel  resources  and  systems  controls. 

7 .  The  Duty  to  Apply  Appropriate  Data  Security  Measures 
Principle 

Because  of  the  sensitivity  of  the  personal  information  stored  in  a  health  data 
system,  security  measures  must  be  taken  to  limit  access  by  personnel  within  the 
organization  to  those  with  a  need  to  see  particular  information  items  in  a  record, 
to  monitor  data  uses  in  order  to  detect  unauthorized  conduct,  and  to  protect  files 
against  outside  penetration. 

Discussion 

Providing  adequate  data  security  represents  one  of  the  least  controversial 
principles  for  health  data  system  managers  to  follow:  everyone  will  agree  that  it 
is  necessary    and  there  are  well-understood  techniques  that  computer  experts  know 
how  to  apply.     The  key  issues  that  arise  are  (1  )  the  need  for  management  to  for- 
mulate clear  policies  as  to  data  access  that  data  security  measures  can  then  carry 
out;   (2)  the  need  to  make  assessments  of  the  foreseeable  threats  to  data  security, 
based  on  prior  breaches  of  information  security  or  new  risks  posed  by  especially 
attractive  records;  (3)  the  need  to  adopt  a  blend  of  security  measures  (locks  on 
terminals,  passwords  or  cards  to  access  files,  audit  trails  to  monitor  use,  etc.) 
that  will  provide  as  much  security  as  a  reasonable  expenditure  of  money  and  personnel 
can  produce;  and  (4)  the  need  to  adopt  special  measures  to  safeguard  files  of  unusual 
sensitivity,  such  as  psychiatric  records  in  a  general  hospital,  as  by  storing  such 
data  on  separate  minicomputers  in  locked  facilities. 

Just  as  no  data  system  can  be  100;?^  accurate,  so  no  system,  manual  or  automated, 

can  be  made  100^  secure.     This  is  true  even  in  national  defense  and  intelligence 

computer  installations,  where  huge  sums  are  spent  on  security  measures  and  elaborate 

screenings  and  surveillance  of  employees  are  used.     The  basic  goals  of  data  security 

in  health  data  systems  should  be  to  block  or  detect  attempts  by  the  organization's 

own  personnel  to  obtain  confidential  data  they  are  not  authorized  to  have,  and  to 

make  the  cost  and  trouble  to  outsiders  of  breaking  into  the  system  sufficiently  high 

as  to  dissuade  almost  everyone  from  trying  it,  or  defeat  them  when  they  do.  Computer 

manufacturers,  consulting  firms,  industry  groups,  and  a  variety  of  governmental 

agencies  can  usually  supply  whatever  assistance  organizational  managers  and  their 

data  processing  staff  may  need.    The  adequacies  of  security  measures  can  be 

measured,  in  part,  by  the  history  of  threats  to  confidentiality  in  that  type  of 
organization. 

8.  The  Duty  to  Inculcate  Respect  for  Citizen  Rights 
Principle 

Since  there  is  a  great  gap  between  publishing  organizational  rules  or  enacting 
legal  rights  and  achieving  positive  compliance  with  their  spirit  and  letter  in  daily 
life,  every  health  data  system  should  develop  orientation  programs,  interpretive 
guidelines,  continuing  seminars,  problem-solving  sessions,  special  training  materials, 
and  annual  reviews,  to  foster  understanding  and  acceptance  of  the  system's  policies 
on  citizen  rights  by  the  organization's  own  personnel.     Such  programs  should  rec- 
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ognize  and  deal  with  the  special  attitudes  of  major  occupational  groups  in  the  organ- 
ization (doctors,  nurses,  other  health  workers,  administrators,  data  processing 
staffs,  etc.).     Wherever  possible,  patients  and  public  representatives  should  be 
included  in  the  development,  management,  and  evaluation  of  these  educational  programs. 

Discussion 

Operating  a  health  organization  and  its  data  system  under  the  kind  of  ethical 
guidelines  proposed  here  cannot  help  but  disturb  customary  ways  of  thinking  and 
behaving  by  organizational  personnel,  especially  the  medical  professionals.  Every 
organization  that  we  studied  which  made  important  changes  in  its  policies  to  promote 
citizen  rights  had  to  develop  initial  guidelines  for  its  people,  conduct  orientation 
sessions,  review  progress  and  problems  on  a  regular  basis  with  its  full  staff,  and 
compile  new  guidelines  and  procedures  on  the  basis  of  experience.     The  promulgation 
of  patients  rights  at  the  Martin  Luther  King  Jr.  Health  Center,  the  IBM  Corporation's 
revision  of  employee  privacy  policies  and  procedures  in  1974-75,  and  the  way  Drs. 
Weed  and  Golodetz  managed  their  patient-access-to-records  projects  are  vivid  examples 
of  the  planning,  communications,  and  evaluation  efforts  that  go  into  achieving  support 
for  innovative  policies  in  an  on-going  organization. 

In  calling  for  such  supportive  activities,  as  countless  studies  of  change  in 
business  and  governmental  organizations  attest,  the  attitudes  of  the  top  management 
play  a  central  role.     If  the  central  administration  and  department  heads  of  any 
organization  are  only  formally  committed  to  the  new  policies,  communicating  a  spirit 
of  resentfulness  and  smnoyance  at  this  "intrusion"  into  their  more  important  affairs, 
this  soon  communicates  itself  throughout  the  staff  and  sabotages  positive  compliance. 
In  the  examples  of  outstanding  supportive  programs  mentioned  above,  the  commitment 
of  each  organization's  leaders  was  highly  positive,  and  this  was  unmistakably  com- 
municated throughout  the  organization  by  both  word  and  deed. 

It  can  be  noted  that  these  were  citizen  rights  reforms  initiated  by  the  leader- 
ship itself;  securing  management  enthusiasm  for  policies  that  are  required  by  new 
legislation,  court  decisions,  or  professional  codes  may  be  rather  more  difficult. 
For  example,  we  found  a  less-than-enthusiastic  attitude  toward  some  of  the  Federal 
Privacy  Act's  requirements  among  several  federal  agencies  in  the  health  field  that 
we  contacted.     Despite  this  difference  between  voluntary  pioneers  and  law-compliers , 
it  is  still  vital  to  the  movement  from  new  policy  to  daily  observance  that  each 
organization  take  the  kind  of  steps  we  have  described. 

9 .  The  N"eed  for  a  Patient's  Rights  Handbook  and  a  Patient  Rights  Representative 
Principle 

Every  health  data  system  in  primary  care  should  publish  a  clearly  written  guide- 
book on  patient's  rights  and  responsibilities  that  is  given  to  an  individual  at  the 
earliest  point  of  contact  with  the  facility.     Each  system  should  also  have  a  person 
who  serves  as  a  patient's  rights  representative  or  ombudsman,  with  the  presence  and 
means  of  contacting  this  representative  described  in  the  handbook  given  to  every 
patient.     While  a  rights  handbook  and  patient  representative  should  not  be  limited 
to  record-keeping  and  data  issues,  the  creation  of  a  data  system  represents  a  key 
occasion  for  organizations  that  do  not  already  have  such  services  to  bring  them  into 
being. 
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Discussion 

The  need  to  inform  patients  that  they  have  rights  and  how  to  exercise  them  has 

been  recognized  by  the  promulgation  of  the  American  Hospital  Association's  Bill  of 

1 8 

Rights  for  Hospital  Patients,      and  similar  codes  that  have  been  issued  recently  for 
special  populations,  such  as  nursing  home  patients,'''^  children,      and  persons  who 
are  developmentally  disabled. Just  what  the  nature  and  exercise  of  these  rights 
should  be  is  the  subject  of  considerable  discussion  among  health-care  professionals, 
consumer  and  civil  liberties  groups,  and  medical  organizations,  but  the  importance 
of  such  codes  is  now  firmly  recognized. 

Within  organizations  creating  health  data  systems,  each  patient  ought  to  receive 
a  pamphlet  or  handbook  such  as  the  one  developed  at  the  Martin  Luther  King  Jr. 
Health  Center.     The  experience  there  shows  that  the  very  publication  of  such  a 
patient's  rights  document  helps  to  orient  the  staff  to  its  responsibilities  and 
promises,  improves  patient-staff  relationships,  and  serves  as  an  objective  guide 
for  the  resolution  of  disputes  that  may  arise. 

The  critical  element  in  making  patients'  rights  more  than  a  paper  declaration, 
however,  is  the  presence  of  an  independent  patient's  rights  representative  to  whom 
patients  can  complain  or  seek  help.     Such  a  person  must  have  authority  to  investi- 
gate patient  complaints,  hold  meetings  with  staff  and  between  staff  and  patients 
where  this  is  useful,  and  to  direct  staff  compliance  with  the  organization's  policies 
where  these  are  found  to  have  been  violated. 

How  to  create  such  a  representative  and  assure  his/her  independence  might  be 
accomplished  in  various  ways.     If  the  organizations'  philosophy  and  top  management 
are  fully  committed  to  patient's  rights,  as  at  the  Martin  Luther  King  Jr.  Center, 
the  representative  can  be  an  employee  of  the  institution.     In  the  average  hospital 
or  health  center,  there  may  be  problems  with  an  employee  exerting  independence  and 
enforcing  patient  rights  against  medical  staffs  or  administrators.     However,  trying 
to  overcome  that  problem  by  lodging  such  a  function  in  a  government  bureau  or  out- 
side private  body  has  the  disadvantage  of  removing  the  patient  representative  from 
daily  in-the-f acility  availability,  which  is  often  critical  to  the  needs  of  patients. 
The  most  promising  approach  may  therefore  be  to  identify  the  role  of  patient  repre- 
sentative as  one  that  demands  independence    and  advocacy  on  the  part  of  the  person 
filling  it,  and  using  all  the  available  mechanisms  of  professional  and  public  re- 
view to  see  that  primary  care  institutions  permit  such  representatives  to  do  their 
jobs  in  that  spirit. 

1 0.  The  Keed  for  Independent  Audit  and  Periodic  Review 

Principle 

Because  the  use  of  EDP  by  organizations  is  not  a  one-time  decision  as  to  what 
will  be  automated  and  how,  but  a  continuous  process  of  expanding  initial  computer 
applications  to  additional  files,  new  combinations  of  data,  and  more  extensive  data 
utilization,   (often  reflecting  new  technological  resources)  any  health  data  system 
must  be  subject  to  regular  review  by  an  independent  body.     Such  periodic  review 
should  focus  not  only  on  the  continuing  adequacy  of  the  organization's  policies 
and  data  security    in  light  of  changing  data  processing  practices,  but  also  examine 
any  major  expansion  of  the  data  system  that  would  have  significant  impact  on  its 
treatment  of  citizen  rights. 
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Discussion 

As  our  description  and  analysis  of  computer  use  in  health  care  has  shown,  the 
pace  of  automation  in  primary  care  has  begun  to  accelerate,  and  major  expansion  of 
computer  use  is  predicted  in  the  next  decade  among  hospitals,  health  centers,  doctors' 
offices,  service  payer  organizations,  and  quality-care  reviewing  groups.     If  projects 
to  develop  integrated  information  systems  for  hospitals,  lifetime  patient  medical 
histories,  regional  planning  systems,  and  similar  experiments  progress  as  their  pro- 
ponents helieve  they  will,  the  late  1970s  and  early  1980s  could  be  a  time  of  rapid 
change  in  the  world  of  health-care  computer  use. 

Projecting  this  against  the  essential  dynamism  of  computer  applications  in  organ- 
izations, and  the  pattern  of  major  changes  in  computer,  communications,  and  optical 
technologies  that  have  marked  these  fields  during  the  past  two  decades,  good  public 
policy  requires  that  outside  review  of  an  organization's  data  system  not  be  treated 
as  a  one-time  certification  process.     When  a  hospital  installs  a  computer  to  process 
payroll,  personnel,  patient  billing,  and  lab  testing  results,  it  has  done  something 
which  raises  very  different  issues  than  when  it  later  automates  patient  histories 
and  problem-oriented  records,   joins  a  regional  health  planning  information  system, 
and  decides  to  send  its  patient  data  to  an  organization  like  the  Multi-State  Psychi- 
atric Information  System. 

For  these  reasons,  periodic  review  by  an  outside  body  ought  to  be  used  for  all 
health  data  systems.    As  we  noted  in  our  discussion  of  who  would  conduct  such  reviews 
when  health  data  systems  were  first  created,  or  when  public  notice  and  impact  state- 
ments were  first  installed  as  public  policy,  independent  review  could  be  through  a 
private  commission  or  association,  a  state  regulatory  agency,  or  a  federal  body. 
Whichever  type  of  review  body  is  chosen,  it  ought  to  have  rights  of  inspection,  audit, 
and  testing  similar  to  those  of  an  outside  financial  auditor  or  professional  standards 
reviewer. 

1 1 .  The  Need  to  Insure  Information  for  Public  Oversight 
Principle 

There  is  an  inevitable  tension  between  the  individual's  right  of  privacy  and 
the  public's  right  to  examine  and  supervise  how  its  social  institutions  are  operat- 
ing (especially  when  these  are  heavily  supported  by  public  funds).     The  rules  of 
confidentiality  set  by  health  data  systems  should  be  examined  carefully  to  avoid 
adding  to  the  already  existing  difficulties  in  policing  compliance  with  health 
program  requirements  and  assessing  the  quality  of  health  care  that  providers  are 
giving.     Using  medical  records  without  unique  identifiers  or  with  potentially- 
identifiable  data  removed  represents  the  major  technique  for  softening  the  conflict 
between  privacy  and  public-access  interests. 

Discussion 

The  public  has  already  become  aware  of  conflicts  between  the  Federal  Privacy 
Act  of  1974  and  the  newly-amended  Federal  Freedom  of  Information  Law,  and  some 
collision  between  these  two  equally  valued  interests  of  democratic  society  must  be 
taken  as  inevitable,  to  be  resolved  (ideally)  on  a  sensitive,  situation- by-situation 
basis. 

299 

225-346  O  -  76  -  21 


The  problem  with  health  data  systems  is  that  the  public  authorities  that  are 
charged  with  policing  fraud  and  mismanagement,  and  assuring  the  quality  of  care 
paid  for  by  public  funds,  are  part  of  the  same  executive  branches  (federal,  state, 
and  local)  whose  violations  of  privacy,  confidentiality,  and  due  process  have  been 
the  subject  of  anxious  public  concern  during  the  past  decade. 

The  task  of  public  policy,  therefore,  is  to  install  statutes  or  regulations 
that  are  so  clear  as  to  the  uses  that  can  be  made  of  data  obtained  for  public  over- 
sight, and  have  such  workable  prohibitions  and  penalties  against  misuse,  that  the 
public  can  regain  confidence  in  having  medical  records  made  available  to  health- 
agency  personnel.     There  is  also  an  important  need  to  provide  such  access  for  public- 
interest  groups,  the  media,  and  other  participants  in  our  process  of  public  criticism 
and  review. 

V/herever  possible,  such  access  should  be  achieved  by  techniques  such  as  removing 
identifiers  from  records,  using  special  agencies  to  code  and  match  records  that  must 
be  assembled  from  various  institutions,  and  securing  the  individual's  informed  con- 
sent to  use  his/her  records  for  such  purposes.    Where  conflicts  still  arise,  judicial 
review  is  probably  the  best  resolution.     The  federal  and  state  courts  have  shown 
commendable  sensitivity  in  the  past  decade  in  balancing  privacy  claims  and  freedom- 
of- information  claims.     Their  reluctance  to  accept  abstract  fears  about  privacy 
(often  by  highly  self-interested  health-care  providers  and  government  payment  agen- 
cies) and  their  capacity  to  work  out  techniques  for  making  such  critical  personal 
records  available  for  public  review  provide  the  basis  for  reasonable  optimism  in 
this  area. 

1 2 .  The  Importance  of  Research  and  Evaluation  Using  Health  Data 
Principle 

While  securing  informed,  voluntary  consent  should  cover  most  situations  in 
which  medical  research  and  program  evaluations  need  to  be  conducted,  through  the 
use  of  identified  data  from  health  systems,  there  will  be  situations  in  which  this 
is  not  feasible.     In  those  cases,  a  health  data  system  should  have  the  purpose, 
procedures,  and  safeguards  of  the  research  reviewed  by  a  special  panel  made  up  of 
representatives  from  the  organization  owning  the  data  system,  outside  scholars  of 
high  reputation,  and  leaders  of  public- interest  groups  relevant  to  the  research 
project  (minority  racial  groups,  womens '  groups,  civil  liberties  groups,  etc.). 
Furthermore,  securing  a  legal  privilege  against  any  compulsory  disclosure  of 
research  records  should  generally  be  a  prerequisite  for  a  health  data  system's 
agreement  to  participate  in  a  research  study,  disease  register,  or  program  evalua- 
tion involving  highly  sensitive  personal  information. 

Discussion 

Just  as  the  need  for  public  access  to  health  data  must  be  considered  in  setting 
rules  for  health  data  systems,  there  is  a  similar  need  to  consider  how  med- 
ical research  and  health-program  evaluations  will  be  affected  by  citizen  rights 
policies , 

As  we  noted  in  Part  One,  there  has  been  well- justified  criticism  of  certain 
research  activities  in  recent  years  for  violating  civil  liberties.     This  has 
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included  research  on  dependent  or  institutionalized  people  without  their  knowledge 
or  consent,  research  that  does  harm  to  those  on  whom  it  is  conducted,  research 
whose  procedures  violate  ethical  standards,  and  research  that  further  stigmatizes 
various  minority  groups  and  cultural  dissidents. 

Because  our  study  deals  with  record-keeping  and  data  systems,  we  noted  these 
issues  in  Part  One  only  to  the  extent  that  they  involved  the  creation  and  use  of 
personal  records.     In  our  report  on  the  impact  of  computerization,  however,  we  saw 
that  public  concern  over  these  types  of  abusive  research  activities  helped  fan 
public  hostility  to  the  creation  of  some  state  computerized  health  data  systems  for 
research  or  evaluation.     We  also  noted  that  the  failure  of  many  such  systems  to 
install  careful  and  detailed  safeguards  against  misuse  of  research  data  further 
Inflamed  the  situation. 

Recognizing  that  there  is  a  considerable  amount  of  rational  (as  well  as  irra- 
tional) "anti-research"  sentiment  at  large  today,  we  must  also  recognize  that  the 
importance  of  medical  research  to  society  and  each  of  its  members  has  probably  never 
been  greater  than  it  is  today.     National  health  is  deeply  imperiled  by  harmful  en- 
vironmental conditions,  dangerous  foods  and  drugs  in  common  use,  public  smoking, 
substances  used  at  work  that  produce  major  diseases  among  workers,  and  a  variety 
of  other  conditions  that  must  be  systematically  studied  and  reported  upon  if  public 
health  is  to  be  protected.     Further  progress  in  dealing  with  major  killer  diseases  — 
cancer,  stroke,  and  the  like  —  depends  on  large-scale  research.     The  relationship 
of  chemical  processes  to  emotional  disorders,  and  their  responsiveness  to  chemical 
interventions,  is  another  example  of  prime  research.     In  these  and  hundreds  of  other 
situations,  researchers  need  access  to  records,  usually  the  identified  medical  re- 
cords of  people  tracked  across  time  and  in  different  medical  settings. 

There  are  also  important  social  interests  in  research  to  evaluate  the  effects 
of  health-care  programs  and  systems.     The  more  that  concepts  of  consumer  choice, 
patient  responsibility  in  health  management,  and  new  models  of  health  delivery  are 
put  forward  as  alternatives  to  traditional  practices,  and  the  more  that  public  or 
private  funds  are  spent  to  underwrite  experimental  programs  along  these  lines,  the 
more  careful  and  objective  evaluations  of  how  these  experiments  work  are  needed 
for  decision  makers.     Precisely  because  there  are  such  mammoth  expenditures  at 
stake,  and  powerful  organizational  interests  that  would  be  served  by  continuing  the 
status  quo,  the  forging  of  political  support  for  enacting  new  health  programs  in 
American  society  must  be  followed  by  commissioning  evaluation  studies  that  will 
test  the  advantages  of  the  new  systems  over  the  old,  and  identify  what  may  need 
modification  in  valuable  new  programs  to  correct  early  defects.     The  sine  qua  non 
of  such  program  evaluation  in  health  care  is  access  to  the  identified  medical 
records  of  individuals  who  participate  in  such  programs,  to  compare  with  the 
experiences  of  individuals  who  are  receiving  different  care. 

V^e  have  taken  a  moment  to  spell  out  the  social  importance  of  these  research 
activities  because  it  should  remind  us  that  the  first  concept  we  presented  as  a 
guide  for  managing  ethical  data  systems  is  that  a  democratic  society  seeks  to  pro- 
vide both  individual  rights  and  a  rationally-ordered  social  system.     These  were  the 
twin  ideals  that  men  like  Jefferson  devoted  their  lives  to  —  pursuing  advances  in 
science  and  the  useful  arts  to  free  mankind  from  the  tyranny  of  nature  and  help 
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foster  the  expansion  of  human  liberty. 

To  carry  out  that  marriage  of  liberty  and  reason,  health  data  systems  should 
usually  be  able  to  rely  on  the  informed  consent  of  their  patients.     When  long-term 
research  is  involved,  this  will  require  a  different  kind  of  informed  consent  than 
the  short-term  procedure  we  described  earlier,  when  release  of  personal  data  for 
third  parties  such  as  insurance  companies,  employers,  or  licensing  bodies  was  in- 
volved. 

Sometimes,  where  the  research  design  is  known  at  the  time  that  patients  are 
about  to  receive  treatment  or  enter  a  course  of  care,  a  full  explanation  of  the 
uses  to  be  made  of  personal  records  can  be  made  and  voluntary  written  consent 
obtained.    Where  research  projects  involve  going  back  to  the  historical  records  of 
patients  to  trace  the  effects  of  certain  drugs,  medical  procedures,  health  habits, 
or  environmental  conditions  on  the  later  health  status  of  individuals,  reasonable 
efforts  should  be  made  to  contact  those  individuals  who  are  to  be  studied  and  to 
secure  their  consent;  only  if  this  is  not  possible  to  do,  because  the  individuals' 
locations  are  not  available,  should  consent  not  be  required. 

The  same  initial  requirement  of  informed  consent  should  be  used  when  program 
evaluations  are  being  done.     If  evaluations  are  properly  explained,  and  the  safe- 
guards against  misuse  of  identified  data  are  spelled  out,  most  people  will  cooperate 
and  let  their  records  be  used;  usually,  they  will  also  be  glad  to  supply  their  ex- 
periences and  opinions  to  researchers.     The  argument  that  making  this  voluntary  and 
having  non-respondents  in  samples  will  throw  off  the  validity  of  sampling  procedures 
is  something  that  must,  ultimately,  be  considered  less  important  for  society  than 
preserving  individual  rights.    Furthermore,  analysis  of  the  patterns  and  reasons 
for  non- response  may  well  be  of  great  importance  in  judging  programs;  where  such 
analysis  is  not  feasible,  there  are  still  techniques  for  minimizing  distortion  of 
results  in  such  situations. 

For  the  exceptional  research  situations  in  which  identified  records  are  needed 
and  individual  consent  cannot  be  obtained,  wo  suggest  the  use  of  special  review 
panels  to  judge  the  social  importance  of  the  research,  the  procedures  to  be  followed, 
the  risks  to  patient  privacy  that  may  be  involved,  and  the  confidentiality  safeguards 
that  will  be  followed  by  the  researcher.     Such  panels  should  be  made  up  of  three 
elements:  persons  from  the  organization  maintaining  the  health  data  system;  outside 
scholars  of  high  professional  reputation  and  experience  in  serving  on  ethics  commit- 
tees; and  public  representatives,  especially  from  groups  that  may  be  involved  as  the 
subjects  of  the  research  (such  as  blacks,  Indians,  welfare  recipients,  women,  etc.). 
Finally,  the  decisive  issue  for  many  health  system  managers  in  deciding  to  authorize 
a  research  project  may  be  whether  there  is  an  adequate  legal  privilege  available  to 
protect  identified  records  from  compulsory  production  in  any  investigative,  prose- 
cutive, or  administrative  proceeding  by  any  governmental  authority  and  from  produc- 
tion in  civil  litigation.     Statutes  providing  such  privilege  have  been  passed  by 

Congress  to  cover  some  executive-designated  research  projects  on  alcohol  and  drug 
22 

abuse.        State  privilege  laws  have  also  been  enacted  for  some  special  research, 
such  as  Maryland's  statute  extending  total  privilege  to  the  data  submitted  by 

23 

public  and  private  mental  health  practitioners  to  the  state  psychiatric  register. 
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However,  despite  arguments  in  xne  courts  that  such  a  privilege  is  guaranteed 
by  constitutional  rights  of  privacy,  and  despite  efforts  to  enact  researcher's 
privilege  laws  at  the  state  or  federal  level,  the  fact  is  that  a  general  privilege 
for  sensitive  research  data  does  not  exist  today.     One  solution  would  be  for  health 
professionals,  medical  societies,  and  health  agency  leaders  to  join  civil  liberties 
and  media  groups  in  campaigning  for  such  research-privilege  laws.     But  if  the 
complexities  of  covering  the  media,  general  academic  research,  public-interest 
research,  guid  medical  research  all  in  one  statute  prove  to  be  insurmountable,  then 
an  alternative  strategy  would  be  to  draft  a  model  law  giving  legal  privilege  to 
medical  research  by  itself.    This  would  be  politically  promising,  since  the  public's 
interest  in  the  security  of  medical  research  data  is  great  and  the  justified  need 
to  produce  it  for  law  enforcement  or  defendant's  rights  purposes  will  arise  less 
often  than  with  media  or  public-interest  research  data.    If  important  research 
utilizing  personal  information  from  health  data  systems  is  not  to  be  thwarted  in 
the  coming  decades,  installation  of  such  protective  legislation  must  be  a  high 
priority  for  health  groups. 

C.  CURRENT  PRIORITIES  FOR  POLICY  ACTION 

The  work  of  refining  and  applying  these  twelve  principles  for  health  data  systems 
is  clearly  a  long-range  task.    It  is  already  under  way  in  some  sectors  (as  where 
government  health  agencies  are  under  fair  information  practices  laws)  but  there  are 
other  areasj  primarily  in  the  state  and  private  sectors,  in  which  the  job  has  barely 
begun. 

It  was  not  the  assignment  of  this  study  to  go  beyond  the  presentation  and  analysis 
of  broad  standards  to  formulate  detailed  recommendations  for  policy  action.  However, 
our  investigation  of  emerging  citizen  rights  problems  in  the  health  field  does  make  it 
possible  to  identify  an  agenda  of  issues  that  now  seem  ripe  for  action.     We  will 
mention  examples  of  issues  that  require  action  through  legislative,  judicial, 
organizational,  suid  citizen-group  initiatives, to  stress  our  conviction  that  such  a 
mixture  of  interventions  is  vital  to  intelligent  policy  in  the  coming  years. 

1 .  Legislative  Priorities 

Some  legislative  actions  involve  pin-pointed  reforms,  in  the  recognition  that 

society  does  not  think  it  wise  to  let  these  matters  be  worked  out  slowly  (and 

uncertainly)  through  judicial  decisions  or  the  fair  information  practices  law  route. 

For  example.  Congress  ought  to  bring  the  use  of  medical  information  in  credit, 

employment,  and  insurance  reports  under  the  protections  of  the  Pair  Credit  Reporting 

Act.     One  can  understand  why  the  legislators  in  1970  decided  not  to  include  such 

data  when  they  took  their  first  major  step  to  regulate  commercial  reporting  services, 

but  the  record  of  the  past  five  years  has  made  it  plain  that  consumers  deserve  to 

have  access  rights  when  medical  data  is  used  to  deny  them  credit,  insurance,  and 

employment.     There  are  important  issues  to  work  out  in  such  an  amendment  to  the 

1970  Act,  such  as  whether  the  individual  would  see  such  information  directly  or  have 

a  physician  of  his  choice  receive  it.     But  the  need  to  remove  the  medical  exemption 

from  this  consumer-protection  law  flows  directly  from  the  principles  presented  earlier, 

and  nothing  presented  by  industry  spokesmen  at  hearings  on  this  issue  is  persuasive 
2 

to  the  contrary. 
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Enactment  of  medical-research  privilege  laws  at  the  federal  and  state  levels 
is  another  specific  legislative  action  that  deserves  priority  treatment.    We  have 
already  discussed  the  absence  of  such  legal  privilege  today  aind  the  continual 
pressures  on  such  data  from  law  enforcement  officials,  administrators,  and  other 
government  bodies.     A  carefully  drafted  medical-privilege  statute  ought  to  command 
wide  professional  and  public  support. 

Given  the  confused  and  uneven  laws  in  the  50  states  on  confidentiality  of 
medical  information  and  patient  access  to  records,  the  development  of  a  model  statute 
and  its  enactment  by  as  many  states  as  possible  would  be  aji  importsint  step  toward 
modernizing  citizen  rights  in  this  area.     The  American  Medical  Association  has  been 
working  on  the  draft  of  such  a  model  statute  for  several  years,  and  their  latest 
version  is  included  in  Appendix  3  of  this  report.     While  there  will  be  important 
differences  between  the  AMA  and  other  groups  on  some  aspects  of  this  law,  the  AMA 
model  bill  represents  an  excellent  starting  point  for  discussion.     If  civil  liberties 
and  public  interest  groups  could  work  cooperatively  with  the  medical  profession  on 
refining  this  measure,  and  agree  to  disagree  where  that  is  called  for,  this  coalition 
could  provide  the  driving  force  for  state  legislative  action.    Similar  coalitions 
between  civil  liberties  groups  and  bankers  associations  have  been  important  in 
fighting  for  privacy  of  bank  records,  ajid  a  coalition  between  civil  liberties  groups 
and  labor  unions  produced  the  state  laws  enacted  recently  to  control  compulsory  use 
of  polygraphs  by  employers  for  hiring  and  other  employment  decisions. 

With  only    5  states  having  enacted  fair  information  practices  laws,  anyone 
concerned  with  the  protection  of  citizen  rights  in  state,  county,  and  municipal  health 
facilities  ought  to  be  pressing  their  states  to  join  Minnesota,  Massachusetts,  Utah, 
Arizona,  ajid  New  Hampshire  in  placing  government  data  uses  under  protective  legislation. 
Indeed,  as  the  Privacy  Protection  Study  Commission  holds  its  hearings  in  1976  into  the 
administration  of  the  federal  and  state  privacy  acts,  and  writes  its  report  on  the 
successes  and  problems  that  have  surfaced  thus  fax  with  such  laws,  a  stronger  and 
improved  model  of  the  Pair  Information  Practices  Law  may  be  developed  for  other  states 
to  adopt. 

Finally,  explicit  citizen  rights  provisions  and  a  general  administrative  system 
that  facilitates  such  rights  should  be  installed  in  any  national  health  insurance 
program  enacted  by  Congress.    The  confidentiality  and  individual-access  policies  just 
enunciated  by  HEW  to  govern  professional  standards  review  (PSRO)  for  Medicare  and 
Medicaid  are  excellent  standards,  and  while  there  is  no  experience  yet  as  to  how  well 
they  will  work,  these  policies  could  be  drawn  upon  for  national  health  insurance  bills 
amd  regulations.        Many  of  the  principles  discussed  in  this  chapter  are  already  in 
these  PSRO  policies  and  could  probably  be  adopted  for  national  health  insuramce  with- 
out too  much  struggle.    However,  several  areas  of  sharp  controversy  can  be  predicted. 

While  some  will  see  national  health  records  as  valuable  sources  for  other 
social  purposes,  protection  of  citizen  rights  requires  that  the  law  have  provisions 
declaring  that  national  health  insurance  data  can  be  used  only  for  administration  gind 
evaluation  of  the  insurance  program, and  that  identified  records  will  not  be  accessible 
for  any  other  governmental  or  private  purpose  (such  as  location  of  deserting  fathers, 
income  tax  enforcement,  police  investigations,  private  lawsuits,  etc.) 
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Some  legislators  will  want  to  follow  the  easy  path  of  using  the  Social  Security 
number  for  this  system,  but  use  of  a  unique  national  health  insurance  number  would 
protect  citizen  rights  by  not  having  medical  records  include  a  number  that  is  often 
known  to  others  smd  whose  presence  in  these  records  would  facilitate  their  linkage 
with  other  files. 

The  tendency  of  many  experts  designing  tTrie  administration  and  data  systems  of  a 
national  health  insurance  program  will  be  to  have  summaries  of  identified  records  for 
every  participant  held  in  one  file  in  Washington,  as  Social  Security  records  are  now 
held.     They  will  also  want  to  have  patient-identified  records  of  cases  on  appeal  for 
denial  of  payment  or  provider  fraud  also  sent  up  to  regional  offices  and  to  Washington. 
Here  too,  proper  concern  for  protection  of  citizen  rights  should  lead  to  a  rejection 
of  such  approaches  in  favor  of  a  system  that  has  identified  records  kept  only  at  the 
local  level,  with  the  local  agency  generating  a  special,  randomized  review  number  and 
removing  all  unnecessary  personal  information  from  any  record  sent  up  for  review  to 
regional  or  national  offices.    Since  the  provider's  identity  would  be  preserved  in  all 
records,  this  ought  not  to  interfere  with  the  audit  trails  necessary  to  police  against 
suspected  fraud  or  misconduct. 

Finally,  some  legislators  will  want  to  use  the  "doctor-knows-best"  principle  to 
govern  an  individual's  access  to  his/her  record  in  the  national  health  insurance 
system.    Following  the  principle  already  presented  in  this  chapter,  we  believe  that 
if  a  medical  professional  has  not  been  able  to  convince  a  patient  through  personal 
counseling  that  direct  patient  access  is  unnecessary  or  unwise,  then  refusing  such 
access  cannot  be  in  the  best  interests  of  the  patient  or  consistent  with  the 
professional  obligation  of  the  physician,  and  access  should  be  permitted  by  law. 

2 .  Judicial  Actions 

Test  cases  are  the  accepted  way  that  individuals  and  groups  seek  to  activate  the 

Americam  state  and  federal  judiciary  to  advance  citizen  rights.    We  have  reported 

quite  a  few  such  test-case  actions  in  Chapter  11,  and  we  learned  of  new  ones  being 
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filed  even  as  we  wrote  these  concluding  remaorks.  '     But  beyond  such  specific 
lawsuits,  we  think  there  is  a  broad  strategy  that  ought  to  be  directed  at  the  courts 
in  the  coming  years,  to  establish  the  common  law  duty  of  private  organizations  and 
the  constitutional  duty  of  government  orgainizations  to  taJce  reasonable  care  in  the 
way  they  handle  sensitive  personal  health  data.    Where  this  is  set  by  statute  or 
regulatory  order,  of  course, that  would  define  such  a  duty  and  make  it  enforceable  at 
law.    But  even  in  the  absence  of  such  laws,  we  think  that  there  is  a  failure  of  legal 
duty  whenever  a  health  data  organization  does  not  adopt  (a)  explicit  policies  to  assure 
rights  of  privacy,  confidentiality,  and  individual  access;   (b)  procedures  to  assure 
appropriate  levels  of  accuracy,  timeliness,  and  completeness;  and  (c)  adequate  data 
security  measures  to  control  improper  uses.    What  constitutes  sufficiently  explicit 
policies,  appropriate  accuracy,  or  adequate  security  measures  would  be  defined 
according  to  the  type  of  organization  and  activity  involved,  and  the  existing  state 
of  the  art  in  data  security  equipment  and  techniques.     Lawsuits  could  be  brought  either 
by  individuals  whose  interests  in  privacy  eind  medical  care  were  threatened  by 
organizations  using  their  data  without  meeting  such  standards,  or  by  public-interest 
groups  sponsoring  class-action  suits  in  the  same  vein. 
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It  can  be  argued  that  setting  such  standards  should  be  the  work  of  legislation, 
executive  order,  or  regulatory-agency  action,  and  that  invoking  the  courts  is  neither 
responsible  public-policy  for  a  democratic  society  nor  a  good  way  to  hammer  out  the 
detailed  rules  so  often  needed.    It  could  also  be  argued  that  this  would  not  give 
orgstnizational  managers  and  computer-systems  developers  the  advance  rules  they  need 
to  avoid  ambiguity,  and  to  help  justify  committing  money  and  staff  to  the  task.  Yet  the 
genius  of  the  American  judicial  system  has  been  its  development  of  new  duties  for 
private  parties  (and  redefinition  of  constitutional  rights)  to  reflect  new  business 
activities  and  technological  change.     In  the  common  law,  this  was  the  way  new  concepts 
of  contract  were  developed  for  mercantile  capitalism,  and  new  concepts  of  tort  law 
for  industrialization.    Judges  today  could  be  equally  creative  in  defining  the  legal 
duties  of  those  who  use  information  technology.    A  failure  of  duty  would  be  careless 
and  negligent  treatment  of  sensitive  personal  data,  and  successful  practices  would 
show  what  is  reasonable  (and  practical) to  conduct.  After  several  leading  cases  had 
set  the  main  lines  of  acceptable  and  unacceptable  conduct,  the  organizational 
managers  and  systems  developers  would  have  the  guidance  they  sought,  and  society 
would  have  activated  an  important  way  of  achieving  continuing  review  of  organizational 
responsibility. 


3 .  Organizational  Responsibilities 

Legislation  and  judicial  decisions  take  time,  and  it  would  be  unrealistic  to 
think  that  many  of  the  priorities  just  discussed  will  be  installed  immediately.  This 
leaves  the  immediate  initiative  for  action  with  organizational  managers.  Furthermore, 
the  standards  that  will  be  used  by  legislators  and  judges  are  often  drawn  from  good 
as  well  as  bad  organizational  practice  in  the  industry  or  programs  being  regulated. 
This  means  that  the  interests  of  organizational  managers  in  avoiding  unwise 
regulation  as  well  as  in  the  discharge  of  their  own  leadership  responsibilities  makes 
it  important  for  managements  to  address  such  citizen  rights  issues  themselves. 

We  think  any  organization  maintaining  a  large-scale  data  system  ought  to  conduct 
the  kind  of  serious,  in-house "privacy  audit"  of  its  principles,  policies,  practices, 
and  procedures  that  IBM  did  in  197^-75;  that  most  federal  agencies  did  in  1975-76  in 
preparation  for  complying  with  the  Federal  Privacy  Act;  and  that  many  businesses  have 
been  doing  in  1976  to  see  that  they  are  not  engaging  in  controversial  practices 
that  would  support  the  enactment  of  proposed  federal  measures  such  as  the  Koch- 
Goldwater  Bill,  H.R.  1984.     Such  a  privacy  audit  should  surface  the  real  problems  in 
the  organization;  its  prime  advantage  is  that  it  then  allows  managements — with 
whatever  outside  help  they  may  need — to  deal  with  those  issues  directly  and  carefully, 
rather  than  having  the  problems  accumulate  and  worsen  through  management  inattention, 
unfocused  data-system  decisions,  and  similar  developments. 

At  the  same  time,  many  professional  groups  have  been  working  recently  to 

formulate  new  sets  of  guidelines  to  deal  with  citizen  rights  issues  in  the  health 

field.     These  include  new  guidelines  from  Blue  Shield,  the  American  Society  of  Internal 

Medicine,  the  American  Psychiatric  Association,  community  health  centers,  social 
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workers,  nursing  home  operators,  and  many  others.        The  concept  of  creating  and 

legalizing  "ethical  data  centers"  that  Dr.  Elmer  Gabrieli    and  his  colleagues  have 
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advocated  offers  another  valuable  souree  of  guidelines  to  draw  on.  ^    The  enunciation 
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of  such  guidelines  has  played  an  important  role  in  American  society  in  defining  good 
practice  and  professional  standards,  and  it  deserves  to  be  used  to  the  fullest  in 
extending  citizen  rights  in  the  health  field. 

k.  Citizen  Group  Actions 

Beyond  health-professional  organizations,  our  study  has  shown  that  the  Americaji 
Civil  Liberties  Union  has  played  the  single  most  important  role  in  raising  citizen 
rights  issues  during  the  past  few  years.     This  has  been  not  only  through  the 
activities  of  the  ACLU  National  Office  and  its  state  affiliate  chapters,  but  also 
through  various  projects  directed  or  supported  by  the  ACLU,  such  as  the  Mental  Health 
Law  Project,  the  Prisoners'  Rights  Project,  the  Juvenile  Rights  Project,  and  the 
Project  on  Privacy  and  Data  Collection.     One  does  not  have  to  agree  always  with  the 
position  taken  by  an  ACLU  chapter  or  the  national  office  to  recognize  that  the 
continued  attention — indeed,  the  increased  attention — of  ACLU  to  health-data  issues  is 
going  to  be  essential  to  the  working  out  of  good  policy  in  the  coming  years. 

Beyond  that,  the  recent  formation  of  the  National  Commission  on  Confidentiality 

of  and  Access  to  Health  Care  Records  is  a  promising  development.     Composed  of  18 

leading  organizations  in  the  health  field,  and  growing  out  of  the  excellent  conference 

on  confidentiality  held  in  Key  Biscayne,  Florida  in  late  197^,  the  Commission  could 

well  sponsor  just  the  kind  of  activities  in  research,  legislative-drafting,  consulting, 

and  public  testimony  that  is  needed  to  give  coherence  amd  a  consensus-forming 
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mechanism  to  efforts  m  this  area. 

Finally,  is  there  any  special  role  to  be  played  by  computer  professionals  in  the 
protection  of  citizen  rights  in  health  care?    It  can  be  argued  that  computer 
professionals  can  make  their  best  contribution  within  the  organizations  they  work  for 
(e.g.,  hospitals,  state  health  departments,  etc.);  as  private  citizens  participating 
in  public  debates  over  databank  issues i  in  meetings  dealing  with  medical  computing, 
such  as  the  MEDINFO  conventions;  or  through  the  general  activities  of  computer  groups 
such  as  the  Association  for  Computing  Machinery,  the  American  Federation  of  Information 
Processing  Societies,  and  similair  groups.     These  are  all  importamt  activities,  yet 
there  is  an  additional  one  that  deserves  consideration.    When  particular  government 
data  systems  are  being  considered  in  local  communities  or  at  the  state  level,  whether 
these  are  systems  in  criminal  justice,  welfare,  health,  tajcation,  or  other  fields, 
informed  computer  professionals  can  do  a  great  deal  to  help  the  public  interest  groups 
concerned  about  citizen  rights  to  understand  how  such  proposed  systems  will  work,  or 
how  existing  systems  are  working.     The  computer  professionals  cam  also  suggest  how 
protections  can  be  worked  out  within  such  systems,  what  the  costs  are  likely  to  be, 
and  how  such  systems  could  be  effectively  monitered.     In  addition,  whenever  public 
advisory  groups  or  independent  audit  groups  are  set  up  for  such  data  systems,  the 
addition  of  a  citizen-rights  oriented  computer  professional  not  employed  by  the 
government  is  usually  essential  to  such  a  group  being  able  to  exercise  meaningful 
oversight. 

Sometimes  computer  professionals  volunteer  for  this  work  or  do  so  as  members  of 
the  public-interest  or  civil  liberties  groups.     But  the  relative  infrequency  of  this 
professional  participation  (not  only  in  the  health  field  but  in  others  as  well)  suggests 
that  we  may  need  some  kind  of  organizational  assistance.     If  the  major  computer 
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associations,  both  nationally  and  through  their  local  chapters,  could  publicize  the 
availability  of  volunteer  experts  to  help  citizen  groups,  or  to  serve  on  public 
advisory  committees  and  oversight  committees,  or  to  advise  legislative  committees 
needing  help  in  sorting  out  the  issues,  this  might  provide  the  kind  of  linking 
mechanism  that  does  not  seem  to  be  in  place  yet  in  the  thousands  of  local  communities 
and  state  capitols  where  the  tens  of  thousands  of  personal  data  systems  are  being 
built,  expanded,  and  regulated. 

CONCLUSION 

As  American  society  redefines  and  reorganizes  its  health-care  system  in  the 
coming  decade,  it  will  have  to  make  increased  use  of  computer  technology  to  manage 
the  rivers  of  data  that  will  be  generated.     Vital  medical  research,  public-health 
studies,  and  environmental  controls  will  also  require  increased  reliance  on  EDP,  just 
as  there  will  be  powerful  benefits  from  EDP  for  individual  health  care,  in  the 
development  of  permanent  patient  histories,  emergency-treatment  communications  systems, 
and  similar  patient-oriented  activities. 

If  the  question  is  not  whether  but  how  such  technology  will  be  used  in  health 
care,  American  society  has  one  non-negotiable  condition  for  this  process:  basic 
citizen  rights  cannot  be  made  a  casualty  of  technology-assisted  health  systems.  To 
do  so  would  be  to  betray  the  tradition  of  Hippocrates,  and  ultimately  to  dehumanize 
health  care  itself. 

It  is  the  custom  of  Americans  to  believe  that  no  "lady-or-the-tiger"  choice  has 
to  be  made  between  science  and  liberty.    For  200  years,  in  the  tradition  of  Franklin 
and  Jefferson,  we  have  hammered  out  legal  rules  that  allowed  each  successive 
wave  of  invention  to  realize  its  potential,  but  also  required  each  to  be  brought 
under  the  rule  of  law.     Sometimes  it  took  a  while  for  the  principles  of  regulation  to 
become  clear,  and  we  have  come  to  realize  that  the  awesome  effects  of  contemporary 
technology  give  us  less  lead  time  for  social  learning  and  regulatory  response  than  we 
had  in  earlier  eras.     But  that  is  the  challenge  we  face,  and  there  are  promising 
signs  that  our  society  understands  how  important  it  is  to  develop,  soon,  the  standards 
by  which  we  can  pursue  the  benefits  of  both  science  and  liberty  in  the  field  of  health 
csire . 
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Workers,  1975?  Bill  of  Rights,  American  Association  of  Homes  for  the  Aging,  1974. 
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Association,  1975). 
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1.  PROJECT  DOCUMENTS 


22  East  40th  Street       New  York,  N.Y,  10016  (212)725-1222 


July  15,  1974 

To:  Affiliates  and  Local  Chapters 

From:  Alan  F.  Westin,  Chairman,  Privacy  Committee 


As  you  know,   the  Privacy  Committee  proposed  to  the  ACLU  National 
Board,   and  the  Board  recently  adopted,   an  important  policy 
statement  on  protecting  the  privacy  of  patient  medical  records, 
controlling  the  circulation  of  confidential  medical  information,  and 
giving  patients  a  right  of  access  to  their  own  medical  records.  These 
issues  are  going  to  become  more  important  as  plans  for  national 
health  insurance  move  forward,   as  Professional  Standards  Review 
Organizations  (PSRO)   begin  operations,   and  as  medical  records  and 
registers  are  computerized  in  government  databanks  and  private 
organizational  files. 

I  am  writing  to  you  to  ask  whether  you  can  report: 

1.  Any  specific  cases  and  issues  in  which  breach  of  patient  medical 
records  or  medical  information  has  come  to  your  attention.  Clippings, 
briefs,   or  newsletter  reports  would  be  greatly  appreciated;  any 
costs  of  reproduction  or  mailing  will  be  reimbursed. 

2.  Any  exam.ples  of  computerization  of  medical  records  in  your  area 
or  state--by  local  or  state  government  agencies  or  private 
institutions--that  you  have  noted  and  taken  any  action  about. 

3.  Any  recent  policy  resolutions  or  staff  representations  (through 
letters  or  testimony)   on  these  matters. 

I  would  be  most  grateful  if  you  could  send  along  anything  you  have 
on  these  matters,   or  turn  this  letter  over  to  the  specialist  in  your 
affiliate  who  may  follov;  such  topics. 


Many  thanks  for  your  assistance. 


Alan  F.  Westin 


AFW; Ic 


P.S.     Please  send  all  replies  to  my  home  address:   960  Lincoln  Place, 
Teaneck,  New  Jersey  07666. 


Edward  J.  Ennis,  Chairman,  Board  of  Directors  •  Ramsey  Clark,  Chairman,  National  Advisory  Council 
Aryeh  Noier,  Executive  Director  Executive  Department:  Alan  Reitman,  Associate  Director  •  Roger  N. 
Baldwin,  Executive  Director  Emeritus  and  International  Work  Advisor  •  Trudy  Hayden,  Brian  Heffernan, 
Carol  Jennings,  Philip  Ryan,  Helene  Toiv.  Staff  Associates. 

(100%  recycled  paper) 
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22  East  40th  Street    10th  floor    New  York,  New  York  10016    (212)  689-8142  or  725-1222 


Aiai'  F.  VVestin 

Eo.ior  October  31,  1975 

Walter  J  Greon 
rv'anaging  Ed, tor 


To:  Affiliate  Directors 
From:  Alan  F.  Westin 


In  the  suiraner  of  1974.,   as  chairperson  of  the  ACLU  Privacy  Committee, 
I  wrote  to  each  ACLU  affiliate  asking  for  information  about  local  cases 
or  incidents  involving  violations  of  privacy  in  medical  or  health  records. 
I  obtained  many  excellent  replies,  and  have  followed  these  up  with  many 
of  you. 

Now,  I  am  revising  for  publication  a  report  on  the  civil  liberties 
problems  involved  in  manual  and  computerized  files  containing  personal 
health  data.     The  report  covers  whether  medical  or  health  data  ought  to 
be  collected  at  all  in  a  particular  setting   (employment,  education, 
licensing,   etc.);  whether  data  collected  is  being  held  confidentially 
or  is  being  disclosed  to  some  persons  inside  the  collecting  organization 
or  outside  it  who  ought  not  to  receive  that  informatiori;   and  whether 
patients  or  other  individuals  who  have  disclosed  their  health  data  are 
given  a'  right  of  access  to  their  own  records,   if  they  seek  that. 

Could  you  tell  me  whether  you  currently  have  any  incidents,  protests, 
lawsuits,   legislative  activity,   or  other  actions  involving  these  issues? 
I  am  collecting  episodes  covering  both  manual  records  and  computerized 
records , 

I  hope  to  feature  an  accurate  and  strong  presentation  of  how  people's 
rights  in  health  data  are  being  treated  today,  and  I  would  be  most 
grateful  for  any  letters,  clippings,   legal  papers,  or  other  reports  that 
you  can  send  me. 

Would  you  please  address  your  replies  to  me  at: 

The  Civil  Liberties  Review 
22  East  40  Street,   10th  Floor 
New  York,  New  York  10016 

Many  thanks  for  your  help... 


Editorial  Committee  DeTick  A.  Boll.  Jr  .  Norman  Dorsen.  Roliort  F  Dr,nan,  Tticmas  I  Emerson.  Franklyn  S  Haiman,  Charles  V  Hamilton 
Mictiael  Harris,  Elizabeth  Janyway.  Robert  Lekachman.  Jessica  Miiloid,  Harriet  F.  Piipol,  Frances  Fox  Piven,  Inez  Raid,  David  J  Rolhman- 
Andr^ScHiif.'in.  Viln-.a  W.;rtinc.;  Singer.  Marvin  E  Wolfgang.  C  Vann  Woodward 
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PROJECT  ON  MEDICAL  RECORDS  AND  CITIZEN  RIGHTS 

Sponsored  by  the  Institute  for  Computer  Sciences  and  Technolooy,  U.S.  National  Bureau  of  Standards 
960  Lincoln  Place,  Teaneck,  New  Jersey  07686 

Dtrtclor 

A/an  f.  Waslin 

C0...eun,.e,.,y  INCIDENT  REPORT 

This  Project,  as  part  of  its  study  of  the  ways  in  which  automation  of 
personal  medical  records  may  be  affecting  privacy,  confidentiality,  and 
patient  access  to  records,  is  collecting  accounts  of  incidents  in  which 
confidentiality  of  medical  records  has  been  violated,  or  attempts  have  been 
made  to  violate  such  confidentiality,  either  in  manual  or  computer  files. 

Please  describe  any  such  incident  that  you  know  of  in  the  space  below. 
Either  give  it  to  the  member  of  the  Project  that  you  are  in  contact  with 
or  mail  it  to  the  Project,  at  the  address  shown  above.  THANK  YOU  FOR  YOUR  HELP 

Incident     


USE  BACK  OF  BHEET  IF  NECESSARY  FOR  CONTINUATION 

NAI-IE  OF  PERSON  CONTKx-duTING  INCIDENT  ,  

ADDRESS  

(The  name  of  a  person  contributing  an  incident  will  only  be  used  after 
contacting  that  person  and  obtaining  agreement  for  such  identification) 


PROJECT  ON  MEDICAL  RECORDS  AND  CITIZEN  RIGHTS 


Sponsored  by  the  Institute  for  Computer  Sciences  end  Technology,  U.S.  National  Bureau  of  Standards 
960  Lincoln  Place,  Teaneck.  New  Jersey  07666 


Oif*ctor 

Alan  F.  Wesf/n 
Columbia  University 

"'Ten")  A.  Ba^e,  FORM  LETTER  SENT  TO  MEDICAL  OROAIJIZATIOHS 

Brooklyn  College 
City  University  of  N.Y. 
Research  Staff: 
Jamie  Broder 
Richard  Silberberg 
Helene  Toiv 


NAME  AND  ADDRESS 


Under  the  auspices  of  the  U.S.  National  Bureau  of  Standards,  I  am 
directing  a  research  project  on  citizen-rights  issues  involved  in  the 
automation  of  medical  records.     We  are  looking  at  how  patient  records  are 
currently  kept  in  hospitals  and  clinics;  how  computerization  is  affecting 
such  record-keeping  and  the  circulation  of  patient  data  for  repayment 
purposes  and  satisfaction  of  legal  reporting  duties;  and  the  issues  of 
privacy,  confidentiality,  and  patient-access-to-records  that  are  involved 
in  new  forms  of  medical  services,  from  PSRO  and  national  health  insurance 
plans  to  the  growth  of  large-scale  medical  re'search  programs  and  medical 
registers.    A  brief  summary  of  our  project  is  enclosed. 

We  are  writing  to  major  professional  organizations  in  the  health  field 
to  obtain  copies  of  any  recent  policy  statements,  reports,  or  other  materials 
they  may  have  issued  on  the  topic  of  privacy  and  confidentiality  of  medical 
records,  or  on  the  uses  of  computerization  in  patient  record  keeping.  We 
are  also  trying  to  collect  accounts  of  recent  episodes  in  which  the 
confidentiality  of  personal  medical  records  was  violated,  either  for  political 
or  personal  purposes  or  in  order  to  advance  governmental  interests  that 
were  held  to  be  superior  to  the  privacy  of  the  patient  data. 

I  would  be  most  grateful  to  learn  what  your  group  can  report  or  may 
have  published  on  these  issues,  and  I  know  that  readers  of  our  study  will 
want  to  have  your  views  represented. 

May  we  hear  from  you  soon? 


Project  Director 


Medical  Organizations  Contacted 


National  Geriatrics  Society 

Lister  Hill  National  Center  for 
Biomedical  Communication 

Special  Interest  Group  on 
Biomedical  Computing 

American  Association  of 
Medical  Clinics 

American  College  Health 
Association 

Association  of  American 
Fedical  Colleges 

Institute  for  Advancement  of 
Medical  Communication 

Medical  Correctional  Association 

Electronic  Computing  Health 
Oriented, Inc . 

Institute  for  the  Study  of 
Health  and  Society 

American  Hospital  Association 

American  Osteopathic  Hospital 
Association 

Association  of  Medical  Super- 
intendants  of  Mental  Hospitals 

Commission  on  Professional  and 
Hospital  Activities 

Hospital  Management  Systems 
Society 

Association  of  Life  Insurance 
Medical  Directors  of  America 

American  College  of  Physicians 

American  Society  of  Internal 
Medicine 

American  College  of  Obstetricians 
and  Gynecologists 

American  Osteopathic  Association 

American  Academy  of  Pediatrics 

American  Pharmaceutical  Association 

Drug  Information  Association 

Americeui  Academy  of  Family 
Physicians 


American  Dental  Association 

National  Association  of 
Disability  Examiners 

Group  Health  Association  of  America 

Blue  Cross  Association 

National  Association  of  Blue 
Shield  Plans 

American  Academy  of  Health 
Administration 

Assembly  of  Regional  Health 
Planning  Organizations 

National  Health  Federation 

American  Association  for 

Comprehensive  Health  Planning 

American  Medical  Association 

National  Medical  Association 

American  Medical  Record  Association 

American  Association  for  the 
Abolition  of  Involuntary 
Mental  Hospitalization 

Association  of  Mental  Health 
Administrators 

American  Nurses  Association 

American  College  of  Nursing 
Home  Administrators 

American  Nursing  Home  Association 

Citizens  for  Better  Caire  in  Nursing 
Homes,  Homes  for  the  Aged  and 
Other  After-Care  Facilities 

Medical  Liberation  Front 

Association  for  Health  Records 

American  School  Health 
Association 

Student  American  Medical 
Association 

AmericBJi  College  of  Surgeons 

American  Venereal  Disease  Association 

Americein  Medical  Women's  Association 
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Physic igins  Forum 

American  Psychiatric  Association 

American  Public  Health 
Association 

Atomedic  Research  Center 

Brain  Information  Service 

Health  Sciences  Communications 
Association 

American  Association  of  Dental 
Schools 

Living  Bank 

American  Society  for  Hospital 
Pharmacists 

Association  of  American  Physicians 
and  Surgeons 

Association  for  Psychiatric 
Treatment  of  Offenders 

National  New  Professional  Health 
Workers 


Americaji  Medical  Writers' 
Association 

American  Geriatrics  Society 

American  Chiropractic  Association 

International  Society  of 
Cybernetic  Medicine 

National  Environment  Health 
Association 

American  Academy  of  Medical 
Administrators 

American  Association  of  Medical 
Assistants 

National  Association  of  Private 
Psychiatric  Hospitals 

American  Society  for  Medical 
Technology 


2.     PRIVACY  DEFINITIONS,  Developed  by  Dr.  Willis  H.  Ware,  RAND  Corporation, 
September  23,  1975. 

1.  Privacy 

The  right  of  an  individual  to  be  left  alone;  to  withdraw  from  the  influence 
of  his  environment;  or  to  be  secluded,  not  annoyed,  or  not  intruded  upon.  By 
extension,  the  right  to  be  protected  against  physical  or  psychological  invasion 
or  against  misuse  or  abuse  of  something  legally  owned  by  an  individual  or  normally 
considered  by  society  to  be  implicitly  his  property,  e.g.,  one's  home,  one's 
solitude  in  a  public  place,  the  right  to  maintain  something  for  private  use  or  not 
available  to  others. 

2 .  Personal  privacy  (or,  information  privacy) 

(1)  The  claim  of  individuals,  groups  or  institutions  to  determine  for 
themselves  when,  how,  and  to  what  extent  data  about  them  is  communicated  to  or 

used  by  others;  (2)  the  protection  of  an  individual  against  harm  or  damage  as  a 

result  of  the  operation  of  a  record  system;  (3)  the  protection  of  an  individual 

(or  class  of  individuals)  against  unwelcome,  unfair,  improper,  or  excessive 

collection  or  dissemination  of  information  or  data  about  himself. 

3 .  Personal  (computer)  privacy 

The  protection  of  one  or  more  individual( s )  from  harm  or  damage  as  a  result 
of  abuse  or  misuse  of  personal  information  held  on  him  in  some  record  system. 

4.  Invasion  of  privacy 

A  violation  of  some  aspect  of  privacy  or  personal  privacy  as  defined  above; 
in  the  record  system  sense  explicitly,  harm  or  damage  to  one  or  more  individual( s ) 
as  a  result  of  the  operation  of  a  record  system. 

5 .  Data  privacy 

The  protection  of  data  (typically  in  a  computer-based  system)  for  the  sole 
use  of  one  individual  or  organization,  or  by  such  others  as  the  owner  of  the  data 
may  authorize,  e.g.,  other  individuals,  organizations,  agencies,  or  groups  thereof. 

6 .  Conf idential( ity ) 

(1)  Status  accorded  to  data  or  information  indicating  that  it  is  sensitive 
for  some  reason,  therefore  needs  to  be  protected  against  theft  or  improper  use,, 
and  must  be  disseminated  only  to  individuals  or  organizations  authorized  (or 
privileged)  to  have  it;   (2)  by  extension,  status  (sometimes  assured  by  law) 
accorded  to  data  or  information  that  reflects  an  understood  agreement  between 
the  person  furnishing  the  data  and  the  person  or  organization  holding  it  that 
prescribes  the  protection  to  be  provided  and  the  dissemination  and  use  to  be 
permitted;   (3)  a  legally  recognized  relation  between  certain  individuals  (e.g., 
lawyer-client)  that  privileges  communications  between  them  from  disclosure  in 
court.     (Sometimes,  confidential  information  is  legally  required  to  be  given  in 
exchange  for  some  benefit,  privilege,  right,  or  opportunity;  sometimes  it  is 
voluntarily  given. ) 
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7.  Computer  security 

The  totality  of  measures  required  to  (1)  protect  a  computer-based  system, 
including  its  physical  hardware,  personnel,  and  data  against  deliberate  or 
accidental  damage  from  a  defined  threat;   (2)  protect  the  system  against  denial- 
of-use  by  its  rightful  owners;  and  (3)  protect  data  and/or  programs  and/or 
system  privileges  against  divulgence  to  or  use  by  unauthorized  persons. 

8.  Hetwork  security 

The  totality  of  measures  required  to  (1)  protect  a  network  including  its 
physical  hardware,  personnel,  and  information  or  data  against  deliberate  or 
accidental  damage;  (2)  protect  the  network  against  denial  of  use  by  its  rightful 
owners;  and  (3)  protect  the  information  or  data  in  the  network  against  divulgence 
by  unauthorized  recipients.     It  includes  as  a  component  computer  security. 

9 .  Data  security 

The  safety  of  data  from  accidental  or  intentional  but  unauthorized  disclosure, 
modification,  or  destruction. 

10.  Integrity  (of  data  or  systems) 

The  property  of  being  what  an  item  is  thought  to  be,  and  therefore  free  of 
surprises. 

11.  Access  control 

The  set  of  measures  (including  administrative,  procedural,  computer  hardware, 
and  computer  software)  that  (1)  limit  access  to  a  computer  system  to  only 
individuals  authorized  to  use  it;  and  (2)  limit  access  to  information  or  data 
or  programs  within  the  system  to  only  legitimate  users  authorized  to  have  them. 

12 .  Seepage 

The  flow  of  data  or  information  whose  access  is  presumed  to  be  controlled 
by  computer  security  safeguards,  to  unauthorized  individuals  who  obtain  it  by 
circumvention  or  direct  penetration  of  the  system  safeguards. 

13 .  Linkage 

The  combination  of  data  or  information  from  one  information  system  from  that 
from  another;  in  particular,  the  combination  of  computer  files  from  two  or  more 
sources. 
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IN  THE  GENERAL  ASSEMBLY 
STATE  OF 


A  Bill 

To  Provide  For  Confidentiality 
Of  Health  Care  Information 

1  Be  it  enacted  by  the  People  of  the  State  of   ,  represented 

2  in  the  General  Assembly: 
3 

^  Section  1.     This  Act  may  be  cited  as  the    'Confidentiality  Of 

^  Health  Care  Information  Act". 

6 

Section  2.     The  purpose  of  this  Act  is  to  establish  safeguards 

8  for  maintaining  the  integrity  of  confidential  health  care  information. 
9 

Section  3.     For  purposes  of  this  Act  — 

11 

12  (a)     the  term  "health  care  provider"  means  any  person, 

13  corporation,  facility  or  institution  licensed  by  this  state  to 

14  provide  or  otherwise  lawfully  providing  health  care  services,  including 

15  but  not  limited  to  a  physician,  hospital  or  other  health  care  facility, 

16  dentist,  nurse,  optometrist,  podiatrist,  physical  therapist  or  psycolo- 

17  gist,  and  an  officer,  employee  or  agent  of  such  provider  acting  in 

18  the  course  and  scope  of  his  employment  or  agency  related  to  or  sup- 

19  portive  of  health  care  services; 
20 

21  (b)     the  term  "health  care  services  '  means  acts  of 

22  diagnosis,  treatment,  medical  evaluation  or  advice  or  such  other  acts 

23  as  may  be  permissible  under  the  health  care  licensing  statutes  of 

24  this  state; 
25 

26  (c)     the  term  "confidential  health  care  information'  means 

27  information  relating  to  a  person's  health  care  history,  diagnosis, 

28  condition,  treatment,  or  evaluation; 
29 

30  (d)     the  term  "medical  peer  review  committee"  means  a  com- 

31  mittee  of  a  state  or  local  professional  medical  society  or  of  a 

32  medical  staff  of  a  licensed  hospital,  nursing  home  or  other  health  care 

33  facility  provided  the  medical  staff  operates  pursuant  to  written 

34  bylaws  that  have  been  approved  by  the  governing  board  of  the  hospital, 

35  nursing  home,  or  other  health  care  facility,  or  other  organization  of 

36  physicians  formed  pursuant  to  state  or  federal  law  and  authorized  to 

37  evaluate  medical  and  health  care  services; 
38 

39  (o)     the  term  "third  party"  means  a  person  or  entity 

40  other  than  the  person  to  whom  the  confidential  health  care  informa- 
4  1        t ion  relates  and  other  than  a  health  care  provider. 
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1  Section  4.     (a)  Except  as  provided  in  subsection  (b)  or  as  other- 

2  wise  specifically  provided  by  law,  a  person's  confidential  health  care 

3  information  shall  not  be  released  or  transferred  without  the  written 

4  consent,  on  a  consent  form  meeting  the  requirements  of  section  4  (d) 

5  of  this  Act,  of  such  individual  or  his  authorized  representative. 

6  A  copy  of  any  notice  used  pursuant  to  section  4  (d),  and  of  any  signed 

7  consent  shall  be  provided  to  the  person  signing  a  consent  form. 
8 

9  (b)     No  consent  for  release  or  transfer  of  confidential  health 

10  care  information  is  required  in  the  following  situations:     (1)  to  a 

11  physician,  dentist,  or  other  medical  personnel  for  diagnosis  or  treat- 

12  ment  of  such  individual  in  a  medical  or  dental  emergency,  or  (2)  to 

13  medical  peer  review  committees,  or  (3)  to  a  State  Insurance  Department 

14  or  other  state  agency  for  the  purpose  of  reviewing  an  insurance  claim 

15  or  complaint  made  to  such  Department  or  other  agency  by  an  insured  or 

16  his  authorized  representative  or  by  a  beneficiary  or  his  authorized 

17  representative  of  a  deceased  insured,  or  (4)  to  qualified  personnel 

18  for  the  purpose  of  conducting  scientific  research,  management  audits, 

19  financial  audits,  program  evaluations,  or  similar  studies,  but  such 

20  personnel  shall  not  identify,  directly  or  indirectly,  any  individual 

21  patient  in  any  report  of  such  research,  audit,  or  evaluation,  or  other- 

22  wise  disclose  patient  identities  in  any  manner  (the  term  "qualified 

23  personnel"  means  persons  whose  training  and  experience  are  appropriate 

24  to  the  nature  and  level  of  the  work  in  which  they  are  engaged  and  who, 

25  when  working  as  part  of  an  organi3ation,  are  performing  such  work  with 

26  published  and  adequate  administrative  safeguards  against  unauthorized 

27  disclosures),   (5)  by  a  health  care  provider,  as  reasonably  necessary 

28  in  the  provision  of  health  care  services  to  a  person,  or  in  the 

29  administration  of  the  office  or  practice  or  operation  of  a  health 

30  care  provider  (as  used  herein,   "administration"  shall  include,  but 

31  not  be  limited  to,  purposes  of:     accreditation,  reimbursement, 

32  liability  risk  management  or  appraisal, and  defense  or  prosecution  of 

33  legal  actions),  or  (6)  by  an  employer  as  reasonably  necessary  in  the 

34  administration  of  a  group  insurance  or  workmen's  compensation  plan, 

35  or  (7)  upon  the  filing  of  a  claim  for  insurance  benefits,  between 

36  third  party  insurers  to  determine  their  relative  rights  and  obliga- 

37  tions  concerning  the  individual's  entitlement  or  the  amount  or  kind 

38  of  insurance  benefits,  when  the  policy  of  insurance  obtained  by  the 

39  individual  provides  for  obligations  by  more  than  one  insurer  with  respect 

40  to  a  claim  for  benefits. 
41 

42  The  release  or  transfer  of  confidential  medical  information 

43  under  any  of  the  above  exceptions  shall  not  be  the  basis  for  any 

44  legal  liability,  civil  or  criminal,  nor  considered  a  violation  of 

45  this  Act. 
46 

47  (c)     Third  parties  receiving  and  retaining  an  individual's  con- 

48  fidential  health  care  information  must  establish  at  least  the  follow- 

49  ing  security  procedures:     (1)  limit  authorized  access  to  personally 

50  identifiable     confidential  health  care  information  to  persons  having 

51  a  "need  to  know"  such  information;   additional  employees  or  agents 

52  may  have  access  to  such  information  which  does  not  contain  information 

53  from  which  an  individual  can  be  identified;    (2)   identify  an  individual 
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or  individuals  who  have  responsibility  for  maintaining  security 
procedures  for  confidential  health  care  information;   (3)  provide  a 
written  statement  to  each  employee  or  agent  as  to  the  necessity  of 
maintaining  the  security  of  confidential  health  care  information,  and 
of  the  penalties  provided  for  in  this  Act  for  the  unauthorized  release, 
use,  or  disclosures  of  such  information;  receipt  of  such  statement 
shall  be  acknowledged  by  such  employee  or  agent  signing  and  returning 
same  to  his  employer  or  principal  and  the  employer  or  principal  shall 
furnish  his  employee  or  agent  with  a  copy  of  the  signed  statement,  and 
shall  retain  the  original  thereof;   (4)  take  no  disciplinary  or  punitive 
action  against  any  employee  or  agent  who  brings  evidence  of  violation 
of  this  Act  to  the  attention  of  any  person  or  entity. 

(d)     Consent  forms  for  the  release  or  transfer  of  confidential 
health  care  information  shall  contain,  or  in  the  course  of  an  applica- 
tion or  claim  for  insurance  be  accompanied  by  a  notice  containing,  at 
least  the  following: 

(1)  the  need  for  and  proposed  use  of  such  information; 

(2)  a  statement  that  all  information  is  to  be  released 

or  indicating  the  extent  of  the  information  to  be  released,  and 

(3)  a  statement  that  such  information  will  not  be  given, 
sold,  transferred,  or  in  any  way  relayed  to  any  other  person  or 
entity  not  specified  in  the  consent  form  or  notice  without  first 
obtaining  the  individual's  additional  written  consent  on  a  form 
stating  the  need  for  the  proposed  new  use  of  such  information  or 
the  need  for  its  transfer  to  another  person  or  entity,  and, 

(4)  a  statement  that  such  consent  applies  only  to  the 
release  or  transfer  of  confidential  health  care  information 
existing  prior  to  the  date  such  consent   is  signed,  except 

that  when  such  consent  is  given  in  the  course  of  an  application  or 
claim  for  insurance  it  shall  also  apply  to  medical  information 
existing  at  any  time  during  the  period  of  contestability  pro- 
vided for  in  the  policy  and  during  periods  of  ongoing  proofs  of 
loss  during  a  claim. 

Section  5.     (a)  Upon  occurrence  of  an  action  or  decision  of  any 
third  party,  which  adversely  alfects  a  person,  and  which  is  based  in 
whole  or  in  part  upon  his  confidential  health  care  information,  in- 
cluding, but  not  limited  to,  the  following  actions  or  decisions: 
(1)  denial  of  an  application  for  an  insurance  policy;    (2)   issuance  of 
an  insurance  policy  with  other  than  standard  and  uniform  restrictions; 

(3)  rejection  in  whole  or  in  part  of  any  claim  for  insurance  benefits; 

(4)  denial  of  an  employment  application  or  termination  of  employment 
when  such  denial  or  termination  is  for  health  reasons;  and  upon  the 
written  request  of  such  person  or  his  authorized  representative  (or, 
if  such  person  is  deceased,  then  his  heir  or  beneficiary  or  their 
authorized  representative  or  his  estate),  a  third  party  shall  transfer 
all  of  such  person's  confidential  health  care  information  in  its 
possession  to  a  physician  designated  in  such  written  request. 
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1  Prior  to  making  such  transfer,  a  third  party  may  require  payment 

2  of  its  actual  cost  of  retrieval,  duplication  and  forwarding  of  such 

3  information. 
4 

5  (b)    A  physician  receiving  confidential  health  care  information 

6  pursuant  to  (a)  above,  may  review,  interpret  and  disclose  any  or  all  of 

7  such  information  to  the  person  at  whose  request  such  information  was 

8  transferred,  as  said  physician  deems  in  his  professional  judgment  to 

9  be  in  the  best  interests  of  the  person  to  whom  such  information  relates. 
10 

11  (c)    After  reviewing  his  confidential  health  care  information 

12  pursuant  to  this  Section,  a  person  or  his  authorized  representative 

13  may  request  the  third  party  to  amend  or  expunge  any  part  he  believes  is 

14  in  error,  or  request  the  addition  of  any  recent  relevant  information. 
15 

16  UfKjn  receiving  such  a  request,  the  third  party  shall  notify  the 

17  health  care  provider  who  initially  forwarded  such  information  to  the 

18  third  party,  and  when  such  health  care  provider  concurs  with  such 

19  request,  the  third  party  shall  return  such  information  to  that  health 

20  care  provider  for  modification.     Prior  to  making  such  return,  a 

21  third  party  may  require  payment  of  its  actual  cost  of  notice,  duplica- 

22  tion,  and  return  of  such  information.     Except  upon  court  order,  the 

23  third  party  shall  not  itself  modify  such  information.     A  person  after 

24  requesting  and  reviewing  his  confidential  health  care  information 

25  shall  have  the  right,  in  any  case,  to  place  into  the  file  a  statement 

26  of  reasonable  length  of  his  view  as  to  the  correctness  or  relevance 

27  of  existing  information  or  as  to  the  addition  of  new  information. 

28  Such  statement  or  copies  thereof  shall  at  all  times  accompany  that 

29  part  of  the  information  in  contention. 
30 

31  Section  6.     (a)   (1)  Except  as  provided  in  subparagraph  (2)  hereof, 

32  confidential  health  care  information  shall  not  be  subject  to  corapul- 

33  sory  legal  process  in  any  type  of  proceeding,  including,  but  not  limited 

34  to,  any  civil  or  criminal  case  or  legislative  or  administrative  pro- 

35  ceedings  or  in  any  pre-trial  or  other  preliminary  proceedings,  and  a 

36  person  or  his  authorized  representative  has  a  privilege  to  refuse 

37  to  disclose,  and  to  prevent  a  witness  from  disclosing,  his  confiden- 

38  tial  health  care  information  in  any  such  proceedings. 
39 

40  (2)     The  exemption  from  compulsory  legal  process  and  the 

41  privilege  provided  in  subparagraph  (1)  above  shall  not  apply  when: 
42 

43 

(A)     an  individual  introduces  his  physical  or  mental 

44 

condition,  including,  but  not  limited  to,  any  allegation  of 
mental  anguish,  mental  suffering  or  similar  condition  as 
an  element  of  his  claim  or  defense,  provided  that  a  claim 
for  damages  or  other  relief  for    'pain  and  suffering"  based 
solely  on  one's  physical  condition  does  not  constitute  the 
introduction  of  one's  mental  condition  into  issue  and  the 

50 

exemption  and  privilotic  shall  apply   in  sucli  situation  as  to 
tht)so  portions  ol   one's  confidential  health  c;;rc  inlormuLion 
relating  to  mental  comlltion. 
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1  (B)     the  individual's  physical  or  mental  condition 

2  is  relevant  regarding  the  execution  or  witnessing  of  a 

3  will  or  other  document; 
4 

5  (C)     the  physical  or  mental  condition  of  a  deceased 

6  individual  is  introduced  by  any  party  claiming  or  defending 

7  through  or  as  a  beneficiary  of  such  individual; 
8 

9  (D)     in  a  civil  or  criminal  commitment  proceeding,  a 

10  physician,  in  the  course  of  diagnosis,  treatment,  or  medical 

11  evaluation  of  an  individual,  determines  that  an  individual 

12  is  in  need  of  care  and  treatment  in  a  hospital  or  any  other 

13  health  care  facility  which  is  deemed  by  the  individual's 

14  physician  to  be  appropriate  for  mental  illness; 
15 

16  (E)    a  judge  finds  that  an  individual,  after  having 

17  been  informed  that  the  communications  would  not  be  privileged, 

18  has  made  communications  to  a  psychiatrist  in  the  course  of  a 

19  psychiatric  examination  ordered  by  the  court,   provided  that 

20  such  communications  shall  be  admissible  only  on  issues 

21  involving  the  individual's  mental  condition; 
22 

23  (F)     in  any  court  proceeding,   including  an  ex  parte 

24  hearing,  it  is  demonstrated  on  a  prima  facie  basis  to  the 

25  court  that  the  individual's  physical  or  mental  condition  is 

26  of  an  imminent  and  serious  danger  to  the  physical  or  mental 

27  health  of  another  person,  or  to  the  security  of  the  United 

28  States,  or 
29 

30  (G)     in  any  action  by  an  individual  pursuant  to 

31  Section  9  of  this  Act,  or  in  any  policy  action  brought 

32  by  an  individual  against  his  insurance  carrier,  or  by  the 

33  carrier  against  an  insured,  or  in  any  other  action  by  an 

34  individual  wherein  it  is  demonstrated  to  the  court  that 

35  such  confidential  health  care  information  is  relevant  and 

36  material  then  such  court  may  issue  an  order  compelling 

37  production  of  such  information. 
38 

39  (b)     The  exceptions  contained  in  items  (A)  through  (G)  of  sub- 

40  paragraph  (2)  above  are  not  intended  to  preclude  the  exemption  or 

41  privilege  described  in  subparagraph  (1)  above  in  any  pretrial  or 

42  trial  proceedings  under  the  Divorce  Act  of  this  State  unless  the 

43  individual  or  witness  on  his  behalf  first  testifies  as  to  such  confi- 

44  dential  health  care  information. 
45 

46  Section  7.     (a)   Notwithstanding  other  provisions  of  this  Act, 

4  7  health  care  providers  may  make  confidential  health  care  information 
48  available  to  medical  peer  review  committees  without  authorization. 
49 

59  (b)     Confidential  health  care  information  before  a  medical 

51  peer  review  committee  shall  remain  strictly  confidential,  and  any 

52  person  found  guilty  of  the  Unlawful  disclosure  of  such  information 

53  shall  be  subject  to  the  penalties  provided  in  this  Act. 
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1  (c)     Except  as  otherwise  provided  in  this  Section,  the  proceed- 

2  ings  and  records  of  medical  peer  review  committees  shall  not  be  subject 

3  to  discovery  or  introduction  into  evidence.     No  person  who  was  in 

4  attendance  at  a  meeting  of  such  committee  shall  be  permitted  or  re- 

5  quired  to  testify  as  to  any  matters  presented  during  the  proceedings 

6  of  such  committee  or  as  to  any  findings,  recommendations,  evaluations, 

7  opinions  or  other  actions  of  such  committee  or  any  members  thereof. 
8 

9  Confidential  health  care  information  otherwise  discoverable  or 

10  admissible  from  original  sources  is  not  to  be  construed  as  immune 

11  from  discovery  or  use  in  any  proceeding  merely  because  they  were 

12  presented  during     proceedings  before  such  committee,  nor  is  a  mem- 

13  ber  of  such  committee  or  other  person  appearing  before  it  to  be 

14  prevented  from  testifying  as  to  matters  within  his  knowledge  and  in 

15  accordance  with  the  other  provisions  of  this  Act,  but  the  said  witness 

16  cannot  be  questioned  about  his  testimony  or  other  proceedings  before 

17  such  committee  or  about  opinions  formed  by  him  as  a  result  of  said 

18  committee  hearings. 
19 

20  (d)    The  provisions  of  sub-section  (c)  above  limiting  discovery 

21  or  testimony  do  not  apply  in  any  legal  action  brought  by  a  medical 

22  peer  review  committee  to  restrict  or  revoke  a  physician's  hospital 

23  staff  privileges,  or  his  license  to  practice  medicine,  or  to  cases 

24  where  a  member  of  the  medical  peer  review  committee  or  the  legal 

25  entity  which  formed  such  a  committee  or  within  which  such  committee 

26  operates  is  sued  for  actions  taken  by  such  committee,  provided  that  in 

27  any  such  legal  action    personally  identifiable  portions  of  a  person's 

28  confidential  health  care  information  shall  not  be  used  without 

29  written  authorization  of  such  person  or  his  authorized  representative 

30  or  upon  court  order. 
31 

32  (e)     Nothing  in  this  Act  shall  limit  the  authority,  which  may 

33  otherwise  be  provided  by  law,  of  a  physician  licensing  or  disciplinary 

34  board  of  this  State  to  require  a  medical  peer  review  committee  to 

35  report  to  it  any  disciplinary  actions  or  recommendations  of  such 

36  committee,  or  to  transfer  to  it  records  of  such  committee's  preceedings 

37  or  actions,   including  confidential  medical  information,  or  restrict 

38  or  revoke  a  physician's  license  to  practice  medicine,  provided  that 

39  in  any  such  legal  action    personally  identifiable  portions  of  a 

40  person's  confidential  health  care  information  shall  not  be  used  with- 

41  our  written  authorization  of  such  person  or  his  authorized  repre- 

42  sentative  or  upon  court  order. 
43 

44  (f)     No  member  of  a  medical  peer  review  committee  nor  the  legal 

45  entity  which  formed  or  within  which  such  committee  operates  nor  any 

46  person  providing  information  to  such  committee  shall  be  criminally 

47  or  civilly  liable  for  the  performance  of  any  duty,  function,  or  acti- 

48  vity  of  such  committee  or  based  upon  providing  information  to  such 

49  committee;   provided  such  action  is  without  malice  and  is  based  upon 

50  a  reasonable  belief  that  such  action  is  warranted. 
51 

52  Section  8.     (a)  Civil  Penalties  -  Anyone  who  violates  provisions 

53  of  this  Act,  may  be  held  liable  for  special  and  general  damages,  and 
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1  punitive  damages  may  be  granted  for  malicious  violation  of  this  Act. 
2 

3  (b)     Criminal  Penalties  -  Anyone  who  intentionally  and  knowingly 

4  violates  provisions  of  this  Act  shall,  upon  conviction,  be  fined  not  more 

5  than  $5,000,  or  imprisoned  for  not. more  than  one  year,  or  both. 
6 

7  (c)     The  civil  and  criminal  penalties  above  shall  also  be  applicable 

8  to  anyone  who  obtains  an  individual's  confidential  health  care  information 

9  through  the  commission  of  a  crime. 
10 

11  Section  9.     A  person  or  his  authorized  representative  shall  have  the 

12  right,  when  there  is  an  unreasonable  refusal  to  change  the  records  as 

13  provided  in  Section  5,  to  seek  through  court  action  the  amendment  or  ex- 

14  pungement  of  any  part  of  his  confidential  health  care  information  in  a 

15  third  party's  possession  which  be  believes  is  erroneous. 
16 

1'7  Section  10.     Attorney's  fees  and  reasonable  costs  may  be  awarded, 

18  at  the  discretion  of  the  court,  to  the  successful  party  in  any  action 

19  under  this  Act. 
20 

21  Section  11.     Any  agreement  purporting  to  waive  the  provisions  of 

22  this  Act  is  hereby  declared  to  be  against  public  policy  and  void. 
23 

24  Section  12.     If  any  provision  of  this  Act  is  held  by  a  court  to  be 

25  invalid,  such  invalidity  shall  not  affect  the  remaining  provisions  of 

26  this  Act,  and  to  this  end  the  provisions  of  this  Act  are  hereby  declared 

27  severable. 
28 

29  Section  13.     This  Act  shall  become  effective   (one  year) 

30  from  the  date  of  being  signed  into  law. 
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GENERAL.  The  IBM  Company  adheres  to  ethical,  legal  and  confidential 
standards  in  the  handling  of  medical  records  of  its  employees.  Prior 
approval  of  the  employee  (signed  Medical  Information  Release  form)  will 
be  obtained  before  either  disclosing  or  seeking  confidential  medical 
information,  except  in  an  emergency  or  where  such  disclosure  is  required 
by  law.  Management  should  notify  the  involved  employee  and  the 
responsible  Medical  Department  of  the  circumstances  necessitating 
securing  confidential  medical  information.  Neither  management  nor 
Personnel  will  request  or  accept  an  employee's  medical  record.  Access 
to  confidential  medical  records  is  limited  to  the  IBM  Medical  staff  and 
department  personnel  under  their  immediate  supervision. 

Upon  request  to  the  Medical  Department,  employees  will  be  permitted 
access  to  certain  materials  in  their  medical  records  to  which  they  have 
a  legal  right  (such  as  OSHA  data,  Public  Health  data)  and  factual 
medical  data  such  as  laboratory  tests,  blood  pressures,  physical 
findings  (but  not  including  subjective  or  interpretive  data,  or  medical 
opinions).  The  employee  does  not  have  right  of  access  to  the  primary 
active  working  part  of  the  medical  record  which  contains  notes  by  the 
IBM  Medical  staff,  or  to  information  obtained  from  the  patient  which  the 
IBM  physicians/nurses  intended  solely  for  their  own  use,  or  to  third- 
party  communications,  including  information  from  managers.  However,  at 
the  request  of  an  employee  or  in  the  normal  course  of  their  duties ,  IBM 
Medical  personnel  will  discuss  or  interpret  this  information  concerning 
that  employee  on  an  individual  case  basis.  The  custodian  of  medical 
records  will  take  all  reasonable  precautions  to  assure  the  accuracy  and 
reliability  of  the  data,  and  will  correct  any  erroneous  data.  Medical 
personnel  will  be  available  to  interpret  medical  data  from  the  record 
for  the  employee. 


As  appropriate,  managers.  Personnel,  and  employees,  will  be  provided 
with  recommendations  concerning  medical  limitations  pertaining  to 
particular  job  requirements,  but  medically  confidential  information  will 
not  be  provided  to  managers  or  Personnel  without  the  prior  consent  of 
the  employee. 


Employees  must  provide  medical  information  to  IBM  when  the  Company  has 
a  need  to  know  such  information  in  order  to  carry  out  its  policies 
regarding  job  assignment,  benefits,  absenteeism,  international 
assignments,   security.  Workmen's  Compensation,  etc. 


Managers  will  not  consult  an  employee's  private  physician(s)  concerning 
medical  problems,  and  should  resolve  with  the  IBM  Medical  staff  any 
questions  concerning  proper  action.  When  managers  require  verification 
of  facts  with  medical  implications,  they  should  request  that  the 
employee  have  the  appropriate  information  sent  to  the  Medical  Department 
for  interpretation.  Managers  should  recognize  that  our  posture 
concerning  confidentiality  may  result  in  delay  in  the  resolution  of  some 
problems . 
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MEDICAL  RECORDS.  Medical  records  are  confidential  and  private.  An 
employee  has  right  of  access  to  certain  materials  in  his  occupational 
medical  records.  Through  medical  information  releases  the  employee  also 
has  some  control  over  what  material  in  his/her  medical  record  can  be 
used,   to  whom  it  will  be  disseminated,  and  for  what  purpose. 

All  medical  information  except  details  of  first-aid  visits  concerning 
the  individual  employee  is  to  be  maintained  in  one  medical  record.  No 
location  will  maintain  dual  medical  records  on  an  individual  employee. 
There  will  be  no  personally  identifiable  separate  medical  record-keeping 
system.  Individuals  or  legitimate  authorities  acting  in  their  behalf, 
by  presenting  themselves  at  the  medical  records  location,  may  have 
access  to  certain  information  kept  in  their  medical  records,  and  may 
learn  how  it  is  to  be  used.  Accessible  kinds  of  information  are  defined 
below  under  "levels".  Identifiable  information  about  an  individual 
obtained  for  business  purposes  cannot  be  used  or  made  available  for 
other  purposes  without  the  individual's  consent.  (See  section  on 
Voluntary  Health  Screening  Examination  Program  in  this  index.)  Where 
private  medical  advice  is  sought,  and  when  there  is  no  performance 
impact  and  the  law  permits.  Medical  is  under  no  obligation  to  notify 
management  of  restrictions  reflecting  the  presence  of  a  medical 
condition . 


The  individual  responsible  for  the  medical-record  will  correct  any 
erroneous  data  contained  in  the  medical  records  when  such  error  is 
identified  and  documented.  The  responsible  medical  department  must  take 
all  reasonable  precautions  to  assure  the  accuracy  and  reliability  of  the 
data,  and  take  precautions  to  prevent  misuse  of  the  data. 

This  medical-record  system  philosophy  involves  a  concept  of  levels  of 
information  and  accessibility: 


LEVELS. 


Level  I  Material  to  which  the  employee  has  legal  right,  such  as 
Occupational  Safety  and  Health  Act  data.  Public  Health 
data,  and  other  materials  stipulated  by  law. 


Level  II  Medical  data  which  an  employee  should  have  the  right  to 
examine  and'  correct  if  necessary.  This  would  include 
factual  medical  data  that  is  not  subject  to  opinion  or 
subjective  interpretation,  such  as  laboratory  tests, 
blood  pressures,  physical  findings.  Voluntary  Health 
Screening  Examination  Program  Results. 

Level  III  Material  to  which  the  employee  does  not  have  right  of 
access.  The  primary  active  working  medical  record 
containing  notes  by  the  physician/nurse,  information 
obtained  from  the  patient,  or  information  obtained  with 
the  patient's  consent,  which  the  physician  intended 
solely  for  his/her  own  use  in  the  management  of  the  case- 
-third-party     letters,     consultations,     information  from 
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management,  or  copies  of  physicians'  and  hospital 
reports,  psychological  test  data  and  interpretations. 

An  IBM  physician  or  nurse  will,  at  the  employee's  request,  release  and 
discuss  with  the  employee  the  first  two  levels  of  medical  information 
from  a  medical  record.  The  employee  does  not  generally  have  right  of 
access  to  material  classified  as  Level  III.  However,  at  the  request  of 
an  employee  or  in  the  normal  course  of  their  duties,  IBM  Medical 
personnel  will  discuss  or  interpret  Level  III  materials  concerning  that 
employee  on  an  individual  case  basis.  Care  must  be  taken  to  limit 
disclosure  of  Level  III  material  by  IBM  Medical  personnel. 

RELEASES .  An  employee's  informed  consent  (Medical  Information  Release) 
(see  Index  5-2)  is  required  before  medically  confidential  information  is 
released  to  third  parties  (insurance  companies--including  our  own 
carr iers--governmental  agencies,  and  others),  except  as  required  by  law, 
in  which  case  if  feasible  the  employee  should  be  notified  of  the  release 
of  this  information.  It  is  advisable  to  contact  the  employee  if  there 
is  any  question  concerning  understanding,  specificity,  and  possible 
consequences  of  release  of  medically  confidential  material. 

A  Medical  Information  Release  form  must  be  used  for  both  seeking  and 
giving  information.  Basically,  informed  consent  specifies  the  purpose, 
recipient,  source  of  information  requested,  is  voluntarily  executed  by 
the  involved  employee,  is  restricted  usually  to  past  and  present  events, 
a.nd  is  revokable  by  the  employee. 

Except  in  cases  of  emergency,  releases  are  appropriate  for  personal 
physician  contact.  Non-solicited  information  from  personal  physicians 
is  the  responsibility  of  the  personal  physician,  and  such  information 
should  be  used -with  discretion  within  IBM.  It  is  presumed  that  the 
sender  has  been  given  permission  to  release  this  information  and  that 
he/she  may  be  questioned  by  IBM  for  clarification  of  the  information 
received.  Situations  wherein  the  personal  physician  is  also  the  IBM 
physician  require  additional  sensitivity. 

RELEASE  FORMS ■  (Absence)  A  sample  of  the  form  to  secure  medical 
information  from  the  personal  physician  of  the  employee  is  included  in 
Index  5-2.  They  are  initiated  by  management  but  eliminate  the  manager 
as  middle  person  in  the  response;  their  use  is  recommended.  Managers 
should  notify  the  Medical  Department  and  the  employee  of  the 
circumstances  necessitating  the  request  for  releases.  Through  use  of 
Medical  Department  self-addressed  envelopes,  etc.,  provision  must  be 
made  to  allow  the  employee  to  have  medically  confidential  information 
sent  directly  to  the  Medical  Department.  Areas  or  Divisions  developing 
their  own  forms  for  this  purpose  or  other  uses  with  medical  implications 
should  inform  the  Office  of  the  Corporate  Medical  Director.  Location 
Medical  Departments  developing  such  forms  must  work  through  their 
Divisional  or  Area  Medical  Department  for  consultation  and  approval. 
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SPECIAL  PROGRAMS .  In  certain  governitiental  programs  regarding 
handicapped ,  etc.,  the  law  may  require  release  of  data  to  appropriate 
IBM  personnel  or  governmental  agencies.  If  individual  identification  is 
requested,  the  specific  legal  requirements  should  be  clarified  by  IBM 
legal  counsel  prior  to  release  of  information. 

DRUG  AND  ALCOHOL  ABUSERS .  There  is  a  Corporate  program  regarding 
handling  cases  where  the  job  is  impacted.  When  Medical  involvement  is 
management  initiated  and  where  performance  is  impacted,  then  it  should 
be  made  clear  to  the  employee  that  Medical  must  advise  responsible 
management  of  the  basic  illness  so  that  the  proper  medical  program,  can 
be  instituted.  Where  private  medical  advice  is  sought,  and  when  there 
is  no  performance  impact  and  the  law  permits.  Medical  is  under  no 
obligation  to  notify  management  of  restrictions  reflecting  the  presence 
of  a  medical  condition. 


APPLICANTS .  Medical  will  not  reveal  diagnoses  or  other  confidential 
medical  Tnformation  to  managers  or  Personnel  without  prior  approval  from 
the  applicant.  If  the  applicant  has  a  history  of  drug  or  alcohol  abuse, 
he/she  should  be  counseled  to  allow  Medical  to  notify  management.  The 
possibility  of  appropriate  medical  follow-up  should  be  explained  to  the 
applicant.  The  applicant  must  be  notified  that  we  will  inform  managers 
and  Personnel  of  job  restrictions. 

Class  III  applicants  will  be  informed  of  their  problem  by  the  examining 
physician.  The  responsible  IBM  Medical  Department  will  notify  Personnel 
of  the  Class  III  designation.  In  these  cases  regulations  on  employment 
of  the  handicapped  may  apply.  The  Employment  Manager  should  consult 
with  the  responsible  IBM  Physician  on  the  appropriate  course  of  action, 
which  may  include  advice  on  how  best  to  communicate  the  employment 
decision  to  the  applicant.  Each  case  should  be  handled  on  an  individual 
basis,  with  the  utmost  sensitivity  to  the  applicant's  perception  of  the 
decision.  It  is  extremely  important  that  the  file  be  carefully  and 
thoroughly  documented. 

The  IBM  Medical  Department  will  notify  Class  II  applicants  of  their 
medical  problems  and  job  restrictions  and  also  of  the  fact  that  managers 
and  Personnel,  or  other  persons  in  the  Company  with  a  need  to  know,  will 
receive  a  copy  of  the  job  restrictions. 

When  special  tests  such  as  urine  chromatography  for  drugs  are  carried 
out,  it  is  necessary  to  inform  the  applicant  what  the  test  is  for  and 
also  that  there  may  be  some  legal  requirement  to  report  positive 
results.  , 

Governmental  regulations  may  necessitate  notifying  applicants  when  they 
have  a  handicap  classification. 

LEGAL  REQUIREMENT.  Certain  agencies  such  as  Workmen's  Compensation 
Boards,  Public  Health  agencies.  Occupational  Safety  and  Health  Act,  and 
other     regulatory     agencies     operating    under  other  laws,  may  have  legal 
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right  to  confidential  material  with  group  or,  at  times,  individual 
identification. 

In     other     instances,     they     may     have     the     legal  right  to  request  such 
information  but  only  reeive     it     with     the     approval     of     the  affected 
individuals.       Medical     Departments     should     seek     the  help  of  IBM  legal 
counsel  for  clarification  to  avoid  erroneous  interpretation. 

HAZARDOUS  OR  COMPLEX  SITUATIONS  AND  CASES .  There  are  situations  where 
a  physicial  or  emotional  health  problem  seriously  impacts  performance  or 
creates  a  hazard.  In  such  instances,  when  ethically  appropriate, 
restrictions  necessary  to  protect  the  individual,  his/her  co-workers, 
and  the  Company  should  be  instituted.  The  employee  should  be  strongly 
counseled  to  allow  Medical  to  release  the  minimum  of  medically 
confidential  material  so  that  appropriate  instructions  can  be  given  to 
managers  or  first-aid  teams  (e.g.,  diabetic  or  epileptic  employees).  It 
should  be  pointed  out  that  it  is  for  the  benefit  of  the  employee  and 
his/her  co-workers  that  we  wish  to  release  minimal  amounts  of 
information,  and  that  it  is  also  his/her  responsibility  to  the  Company 
to  allow  us  to  take  some  reasonable  action.  Instructions  to  first- 
aiders  on  appropriate  first-aid  assistance  may  compromise  some  aspects 
of  medical  confidentiality,  but  it  would  be  an  extremely  rare  situation 
that  would  necessitate  revealing  a  diagnosis. 

VERIFICATION  OF  MEDICAL  INFORMATION.  Managers  may  occasionally  request 
the  Medical  Department  to  verify  certain  statements  of  fact  or 
conditions  with  medical  overtones  which  an  employee  presents  to  them 
(verifying  that  a  visit  was  made  to  an  emergency  room  or  doctor's 
office,  or  that  a  physician  did",  in  fact,  make  certain  recommendations 
that  could  affect  attendance  or  job  requirements).  It  is  management's 
responsibility . to  request  that  the  employee  procure  statements  or 
provide  documentation  which  can  then  be  sent  directly  to  the  Medical 
Department  for  interpretation. 

HOME  CONTACT  (INCLUDING  TELEPHONE  CALLS )  BY  MANAGERS.  These  are 
administrative  and  not  Medical  Department  issues.  Only  in  an  emergency 
should  a  member  of  the  Medical  staff  visit  or  contact  the  home  of  an 
employee  without  consent,  and  then  only  after  consideration  of  other 
options  (local  authorities,  family  contacts,  personal  physician,  etc.), 
since  even  appropriate  action  could  be  considered  invasion  of  privacy  or 
harassment. 

Contact  with  family  members  should  be  made  only  with  permission  of  the 
employee,  except  in  emergency  situations  or  in  cases  of  a  psychological 
state  where  understanding  may  be  lacking   (See  Index  4-2) . 

COSULTATIONS.  When  seeking  consultation,  the  IBM  practice  regarding  the 
Company's  right  to  request  consultation  and  the  employee's 
responsibility  for  allowing  us  to  receive  a  report  of  the  consultation 
should  be  explained  to  the  employee.  Reference  may  be  made  to  the  About 
Your    Company    booklet:   "The  company,  in  deciding  whether  or  not  you  are 
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entitled  to  benefits,  may  require  an  examination  by  a  physician  of  the 
company's  choice.     The  company's  decision  is  final," 

TAPE  RECORDERS .  Tape  recorders  are  not  to  be  used  for  recording 
employee- physician  conversations.  The  responsible  Medical  Director's 
approval  and  the  employee's  approval  are  required  when  recordings, 
films,   or  TV  tapes  are  proposed  to  be  made  for  educational  purposes, 

INTERNATIONAL  ASSIGNMENTS.  (Refer  to  Index  2-5,)  The  international 
assignment  physical  examination  program  is  designed  to  benefit  the 
employee  and  his/her  family,  and  protect  them  from  difficult  medical 
situations  when  on  international  assignment.  The  IBM  Medical 
Departments  may  require  certain  medical  information  concerning  the 
employee  or  his/her  family  members  so  that  proper  administrative 
recommendations  can  be  made  to  management.  It  is  the  responsibility  of 
the  employee  and  family  members  to  provide  required  information  to  the 
IBM  Medical  Departments,  IBM  must  be  especially  sensitive  concerning 
handling  confidential  medical  information  about  individuals  who  are  not 
IBM  employees. 

As  outlined  under  the  International  Assignment  Transfer  Instructions,  an 
individual  and  family  members  (of  legal  age)  may  individually  be  given 
medical  summaries  regarding  their  individual  medical  status.  IBM 
Medical  Departments  must  be  alert  to  realize  that  medical  information 
regarding  an  adult  (and  certain  information  concerning  minors)  is 
restricted  to  the  individual  concerned.  Discretion  and  sensitivity  must 
be  used  to  avoid  potentially  embarrassing  situations  to  the  individual 
or  family  members,  and  to  the  IBM  Company. 

MEDICAL  CARE  ORGANIZATIONS.  In  future  years  we  anticipate  that  both  our 
Medical  and  Benefits  programs  will  be  impacted  by  Health  Maintenance 
Organizations,  Foundations  for  Medical  Care,  etc.,  as  regards  their 
"total  care"  of  the  patient.  The  relationship  between  each  HMO, 
Foundation,  etc,  the  employee,  and  IBM  must  be  understood  to  avoid 
conflict. 

BENEFITS  PROGRAM.  The  proper  administration  of  the  Total  and  Permanent 
Disability  Plan  necessitates  divulging  some  medically  confidential 
information  at  the  Corporate  level.  Medical  confidence  is  maintained  up 
to  the  final  levels  of  decision-making,  at  which  time  an  IBM  physician 
is  available  to  release  and  interpret  only  the  material  necessary  for  a 
decision  to  be  made. 

VOLUNTARY  HEALTH  SCREENING  EXAMINATION  PROGRAM,  In  keeping  with  the 
intent  of  the  Voluntary  Health  Screening  Examination  Program  and  IBM 
concepts  of  medical  data  privacy  and  confidentiality,  information 
obtained  from  the  examination  is  not  to  be  used  to  restrict  an  employee 
without  his  or  her  prior  approval. 

Information  in  the  medical  data  bank  is  confidential  and,  except  as 
required  by  law,  its     use     is     governed    by     these    privacy  guidelines. 
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Correction  of  erroneous  material  in  the  data  bank  is  required  when 
documented.  Correction  of  material  in  the  data  bank  should  be  discussed 
with  the  Medical  Data  Center  personnel.  As  originally  intended,  release 
of  the  VHSEP  printout  continues  to  be  restricted  (see  next  paragraph)  to 
licensed  practitioners  of  medicine.  Release  of  the  printout  (with  the 
employee's  approval)  to  other  health  organizations  or  individual 
practitioners  would  depend  on  acceptable  practice  in  the  community. 

Routinely  employees  will  not  be  given  the  VHSEP  printout,  but  upon 
specific  request,  a  copy  of  the  printout  must  be  provided  to  them. 
Printouts  are  considered  Level  II  material. 

MEDICAL/PERSONNEL  REVIEW  COMMITTEE  MEETINGS.  These  are  conducted  at 
many  locations.  Medical  personnel  must  be  aware  that  in  such  meetings 
there  is  the  possibility  of  medically  confidential  information  being 
discussed  or  divulged.  Medical  must  be  careful  not  to  divulge  any 
unreleased  confidential  material. 

MEDICAL-RECORD  UPDATE.  To  adhere  to  IBM's  philosophy  concerning  medical 
records ,  it  is  important  that  review  of  restrictions  as  compared  to 
current  medical  status  of  the  employee  be  done  periodically  to  eliminate 
unnecessary  or  outdated  restrictions.  When  accurately  documented 
objective  information  reveals  erroneous  material  in  the  medical  records, 
including  computer  records,  correction  is  required.  Medical  records  are 
not  to  be  purged,  but  incorrect  items  are  left  intact  and  the  error 
uoted,  and  a  corrected  statement  made. 

KEDICAL-RECORD  RETENTION.  Medical  records  on  active  employees  should  be 
retained  intact  without  time  limits.  Stored  records  on  former  employees 
should  be  maintained  according  to  Corporate  Headquarters  Record 
Retention  Standards  or  until  the  statute  of  limitations  expires,  or  the 
legal  requirements  of  OSHA  or  other  governmental  agencies  expire, 
depending  on  which  comes  last.  When  medical  records  are  sent  to 
storage,  they  will  be  handled  in  accordance  with  the  holder's  usual 
methods  of  storing  records. 
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IBM  CONFIDENTIAL 

MEDICAL  INFORMATION  REQUEST  RELEASE 

(Use  to  Secure  Information) 

The  purpose  of  obtaining  medical  information  is  to  assess  an 
individual's  health  status  as  it  relates  to  the  work  environment,  assist 
in  rehabilitation,  and  determine  eligibility  for  sickness  and  accident 
benefits.  This  information  will  be  used  by  IBM  medical  personnel  in  a 
confidential  manner  and  will  not  be  released,  unless  required  by  law. 


To  ^   

(Print  Physician's  or  Hospital  Name) 


(Address ) 


(Area  Code  and  Telephone  Number) 


I,       "  ,  hereby  authorize  and 

(Print  Employee's  Name) 
request  you  to  release  to  the  IBM  Corporation  Medical  Department  a  summary 
of  hospital  and/or  medical  records  in  your  possession  concerning  my 

illness  and  treatment  during  the  period  commencing   

(Date) 

as  requested  by  that  department. 

  (IBM  Location) 


(Address) 


Signed    Date 


Witness  Date 


Previous  to  use  by  the  IBM  Medical  Department  the  individual  may  limit 
or  withdraw  this  authorization  by  contacting  the  IBM  Corporation  Medical 
Department  or  his/her  manager. 

cc:  Employee 
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IBM  CONFIDENTIAL 

MEDICAL  INFORMATION  RELEASE 

(Use  to  Release  Information  from  IBM) 

This  information  should  be  used  in  a  confidential  manner  and  unless  requirec 
by  law  is  not  intended  for  use  by  others  than  the  recipient. 

TO  IBM  MEDICAL  DEPARTMENT: 

I,  ,  hereby  authorize  you  to  release 

(Print  Employee's  Name) 

to 


(Print  Name  of  Physician  or  Hospital) 

(Address) 

(Area  Code  and  Telephone  Number) 

a  summary  of  my  medical  records  in  your  possession  pertaining  to 

 ,   and  covering  the  period 

(Subject  or  Illness) 

from    through   


(Date)  (Date) 


Signed    Date 


Witness  Date 


Previous  to  compliance  by  the  IBM  Medical  Department  the  individual  may 
limit  or  withdraw  this  authorization  by  contacting  the  responsible  IBM 
Medical  Department  in  writing. 

cc:  Employee 
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ISM 


CONFIDENTIAL 


PHYSICIAN'S  REPORT  TO  MEDICAL  DEPARTMENT 


To  111*  Alli-rMlill'J  I'llysitijn: 

Yoli  atr  i(in"">'''il  to  comploto  yclion  C  of  this  form  and  forward  it  in  the  accompanying  pre  aridrc^srd  envolopn.  The 
iMlniii'.wiirri  vnpiiiiiil  will  111;  iiMfl  ill  a  conlidpntial  manner  to  assist  in  rehabilitating  your  patient  and  In  osscssing  his  eligibility  for 
brnrliis  kmiIit  iIii>  company's  Sickness  and  Accident  Plan. 

7lic  aclivilics  ol  lliu  company's  medical  department  In  rehabilitation  are  carried  out  In  close  co-operation  with  the  attending 
physician. 

Medical  Director 

SFC1  ION  A  -  1  o  be  completed  by  the  employee's  manager 

Mi. 
(.115. 

Miss    


given  nainol 


•mployco  Mrlal  no. 


ADDRESS  _ 
DEPT.  NO.  . 
MANAGER 


OCCUPATION 


LENGTH  OF  SERVICE 


This  is 


(Irtt  CD 
supplrrnBOtaty  rcpOrt 


FIRST  FULL  DAY  OF  ABSENCE 
Today's  Date 


SECTION  B  •  To  be  completed  by  employee  (PLCase  print  or  typei 
TO    

phvsici.in's  namo  ft 

I  hereby  authorise  you  to  supply  the  information  requested   


tolephonp  no. 


eniplovcc's  siynatufc 


SUCTION  C 


Attending  Physician's  Report 

1.  Date  of  examination  on  which  this  report  Is  based 

2.  Diagnosis,  including  any  complications   


19. 


GENERAL 


Operation  (if  any]. 


-Date. 


Is  disability  the  result  of:    ILLNESS      NON-INDUSTRIAL  □       INDUSTRIAL  □ 
INJURY       NON-INDUSTRIAL  □       INDUSTRIAL  □ 


REHABILITATION 


Vifhen  in  your  judgement  should  employee  be  able  to  return  to  work? 

a)  to  regular  occupation  full  tiine  

b)  to  regular  occupation  part  time   

c)  to  a  lighter  occupation  full  time   


d)  to  a  lighter  occupation  part  time  

N.B.  IBM  tries  to  arrange  suitable  interim  placement  when  indicated,  in  the 
belief  that  it  is  in  the  employee's  best  interests  to  resume  work,  even  If 
limited,  as  soon  as  physically  able. 


19  , 
19 
19 
19 


REMARKS  AND 
WORK  LIMITATIONS 


Do  you  wish  llih  company's  Mcdicil  Director  to  contact  you  with  respect 
to  the  rehabilitation  of  your  patient'  YES 


DATE 


19. 


ftl0nntuf  a 


-MD. 


Address  (if  other  than  in  Section  R) 
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5.  HEW  DRAFT  POLICIES  ON  CONFIDENTIALITY  FOR  PROFESSIONAL  STANDARDS  REVIEW  ORGANIZATIONS,  1975 


For  the  purposes  of  this  paper,  the  following  definitions  shall  apply: 

A.  PSRO  Data  and  Information 

Data  and  information  which  is  acquired  and/or  generated  by  any  PSRO. 

B.  Individual  PSRO  Data  and  Information 

Computer  or  hard  copy  data  and  information  identifiable  to  a  specific  indi- 
vidual. 

C.  Identifiable  Data  of  Information 

Data  and  information  collected,  generated  or  aggregated  on  a  particular  indi- 
vidual which  identifies  that  individual  either  explicitly  or  by  implication. 

D.  Privileged  Data  and  Information 

Medical  data  and  information  identifiable  to  an  individual  patient,  data  and 
information  indicating  patterns  of  health  care  practices  identifiable  to  indi- 
vidual health  care  practitioners,  records  of  PSRO  determinations  identifiable 
to  individual  health  care  practitioners  and  data  and  information  collected 
and/or  generated  for  medical  care  evaluations  studies  as  defined  in  department 
regulations  and  guidelines. 

E.  Monitoring 

The  review  and  appraisal  of  PSRO  functions. 

F.  Evaluation 

The  determination  of  program  effectiveness  and  the  impact  of  the  PSRO 
program  on  quality  of  care  and  utilization  of  services. 

G.  PSRO  Review  System 

A  system  comprised  of  the  PSRO  and  all  supporting  components  which  assist 
the  PSRO  in  the  review  process  or  are  furnished  PSRO  data  for  administrative 
purposes  under  Titles  18,  19,  and  5  of  the  Social  Security  Act.  The  system  may 
include  (but  is  not  limited  to): 

1.  Hospital(s)  if  delegated  review  authority 

2.  PSRO  review  coordinator(s) — individuals  responsible  for  carrying  out 
PSRO  activity  within  the  health  care  facility 

3.  Medicare  Intermediary(s) 

4.  fndependent  Health  Data  System(s),  e.g.,  discharge  abstract  service 

5.  The  PSRO 

6.  ^^edicaid  State  Agencies  and  Fiscal  Agenjf 

7.  PSRO  Contractors  (any  independent  vendors  providing  data  or  data 
processing  services  to  the  PSRO) 

8.  Medicare  Carriers 

9.  Other  PSROs 

10.  DHEW 

1 1 .  PSRO  Support  Centers 

12.  State  PSRO  Council 

13.  State  Maternal  and  Child  Health  Agencies  (Title  V) 

H.  Health  Care  Practitioners 

Physicians  and  other  health  care  practitioners  who  are  reimbursed  for  services 
through  Medicare,  ^^edicaid,  or  Maternal  and  Child  Health  programs. 

I.  Health  Care  Facilities 

Organizations  and  institutions  involved  in  the  delivery  of  health  care  services 
(e.g.,  hospitals,  nursing  homes,  outpatient  facilities,  etc.) 

J.  Sanction  Proceedings 

Procedures  under  Section  1 157  and  1160  of  the  Social  Security  Act  commencing 
with  the  forwarding  of  a  sanction  report  by  the  PSRO  under  Section  1157. 

K.  PSRO  Deliberations 

Minutes  of  meetings,  notes,  comments,  or  other  forms  of  recordings  which 
evidence  internal  PSRO  discussions  pertaining  to  review  or  sanctions. 
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Policy  Statements 


1.  Notification  to  Public 

The  PSRO  must  establish  and  implement  a  procedure  for  public  notification 
of  the  existence,  scope  and  purposes  of  PSRO  data  system. 

2.  Notification  to  Patients,  Practitioners,  and  Providers 

The  PSRO  must  establish  and  implement  procedures  to  inform  individual 
patients,  health  care  practitioners  and  health  caie  facilities  on  whom  PSRO 
data  and  information  has  been  or  is  being  collected  as  to: 

a.  the  name,  title  and  address  of  the  person  immediately  responsible  for  the 
PSRO  data  system 

b.  those  who  will  have  access  to  the  file 

c.  the  circumstances  under  which  and  the  purposes  for  which  PSRO  data  and 
information  will  be  disclosed 

The  procedures  for  notification  should  be  administratively  efficient,  but 
provide  at  a  minimum  for  general  notification  of  the  above. 

3.  Obtaining  Access  to  own  PSRO  Data  and  information 

Subject  to  restrictions  on  disclosure  of  PSRO  deliberations  (see  #19), 
patients,  health  care  practitioners  and  health  care  facilities  must  be  allowed 
access,  upon  request,  to  their  individual  PSRO  data  and  information  for 
purposes  of  ascertaining  the  accuracy  of  that  data  and  information.  The 
PSRO  must  establish  and  implement  procedures  to  verify  the  accuracy  of  the 
data  and  information;  the  data  and  information  to  be  accessed  shall  not  be 
physically  removed  and/or  transmitted  outside  of  the  PSRO. 

4.  Patient  Access:  Special  Procedures 

When  a  patient  requests  access  to  PSRO  data  and  information  under  para- 
graph 3  above,  the  physicians  of  record  must  be  notified  in  writing  at  least 
ten  working  days  prior  to  patient  access.  The  patient  will  not  require 
physician  authorization  to  access  his  individual  PSRO  data  and  information 
nor  can  the  physician  prevent  patient  access  to  the  data  and  information. 
However,  if  upon  receiving  notification  of  intended  patient  access,  a  physi- 
cian of  record  objects  to  the  release  of  such  information  without  clarifica- 
tion, he  or  his  designee  may  be  present  when  the  patient  accesses  his 
individual  file  to  make  such  clarification. 

5.  Limitation  on  Data  Collection 

The  PSRO  or  any  agent,  organization  or  institution  acting  on  its  behalf  as  a 
collector,  processor  and/or  reviewer  of  information  must  limit  the  collection 
of  PSRO  data  and  information  to  that  necessary  for  the  purposes  of  PSRO 
review  and/or  evaluation. 

6.  Limitation  on  Data  Access 

Each  component  of  the  PSRO  review  system  will  have  access  only  to  that 
PSRO  information  and  data  necessary  to  carry  out  its  functions  within  the 
system. 

7.  Limitations  on  Establishment  of  a  National  PSRO  Data  Base 

Privileged  data  and  information  shall  not  be  stored  in  a  manner  which  con- 
stitutes creation  of  a  national  PSRO  data  base. 

8.  Codification  of  Personal  Identifiers 

Identification  of  individual  patients,  health  care  practitioners  and  health 
care  facilities  on  PSRO  generated  reports  and  forms  must  be  in  a  coded 
form  except  for  verification  purposes  as  provided  for  in  paragraph  3  above. 
Index  files  containing  cross  reference  of  codes  to  names  of  patients,  prac- 
titioners and  facilities  will  be  maintained  in  a  secure  manner  within  the 
PSRO  review  system. 

9.  Purgation:  Computer  Files 

Computer  files  may  be  maintained  indefinitely;  however,  each  PSRO  must 
purge  such  files  of  all  personal  identifiers  as  soon  as  such  identifiers  are  no 
longer  necessary  (guidelines  recommending  time  periods  will  be  developed) 
for  purposes  of  review,  appeals,  program  monitoring  and  program  evalu- 
ation. 

10.  Purgation  of  Hard  Copy 

Privileged  information  maintained  in  hard  copy  must  be  purged  when  that 
information  has  served  the  specific  purpose  for  which  it  was  generated. 
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11.  Responsibility  for  Confidentiality  Vested  in  a  Single  Individual 

A  single  individual  within  the  PSRO  must  be  assigned  the  responsibility  for 
maintaining  the  confidentiality  of  PSRO  data  within  the  PSRO  review 
system  and  for  the  notification  to  DHEW  of  any  breaches  of  confidentiality 
within  the  review  system.  A  plan  for  implementing  this  responsibility  will 
be  submitted  to  DHEW  for  approval. 

12.  Responsibility  of  Officers  and  Employees 

All  officers  and  employees  of  the  PSRO  and  components  of  the  PSRO  review 
system  must  be  made  aware  of  their  responsibility  to  maintain  the  confi- 
dentiality of  PSRO  data  and  information  and  of  the  legal  penalties  which 
may  be  assessed  for  unauthorized  disclosure  of  PSRO  data  or  information 
(i.e.,  fined  not  more  than  51,000  and/or  imprisoned  not  more  than  six 
months,  under  section  1166(b)  of  the  Social  Security  Act). 

13.  Authorized  Access:  Requirements 

An  individual  officer  or  employee  of  a  component  of  the  PSRO  review 
system  may  not  be  authorized  access  to  privileged  PSRO  data  and  informa- 
tion until  that  individual: 

a.  Has  completed  a  training  program  in  the  handling  of  such  data  and  in- 
formation pursuant  to  paragraph  14  below;  and 

b.  Has  signed  a  statement  indicating  that:  (1)  the  individual  recognizes  his 
responsibility  to  hold  the  data  in  confidence,  and  (2)  is  aware  of  the  legal 
penalties  which  may  be  assessed  for  unauthorized  disclosure  of  such  data 
and  information  (i.e.,  fined  not  more  than  $1,000  and/or  imprisoned  not 
more  than  six  months). 

14.  Training  Requirements 

It  is  the  responsibility  of  the  PSRO  to  provide  an  ongoing  program  of 
training  in  the  handling  of  PSRO  privileged  information  for  those  officers 
and  employees  of  PSRO  review  system  components  authorized  to  handle 
such  data. 

15.  Access  to  Hard  Copy 

Each  access  to  privileged  data  and  information  which  requires  removal  of 
the  data  or  information  outside  of  a  PSRO  review  system  component,  must 
be  recorded  in  such  a  manner  as  to  indicate  what  material  was  accessed, 
purpose,  when,  by  whom,  where  the  material  was  taken,  and  when  returned. 
A  separate  log  shall  be  kept  recording  access  to  the  index  code  file  (see 
paragraph  8).  This  log  shall  indicate  the  purpose  of  access,  when,  and  by 
whom. 

16.  Disclosure:  Licensing  Boards 

Copies  of  sanction  reports  forwarded  to  the  Secretary  of  DHEW  under 
Section  1157  of  the  Social  Security  Act  may  at  the  same  time  be  forwarded 
to  state  licensing  boards.  However,  the  practitioner  or  facility  must  be  noti- 
fied in  writing  at  least  15  working  days  prior  to  disclosure  to  permit  the 
submission  of  a  statement  to  accompany  the  disclosed  sanction  report.  If 
the  licensing  board  has  been  forwarded  a  copy  of  a  sanction  report,  the 
PSRO  shall  inform  the  licensing  board  of  the  DHEW  determination  within 
a  reasonable  time  after  determination  is  made. 

17.  Disclosure:  Civil  Litigation 

Subject  to  regulations  governing  administrative  hearings  under  section 
205(b)  of  the  Social  Security  Act,  privileged  data  and  information.  PSRO 
sanction  reports  and  PSRO  deliberations  shall  not  be  subject  to  subpeona 
or  discovery  proceedings  in  any  civil  action;  nor  shall  any  PSRO  member, 
employee  or  consultant  be  subject  to  subpeona  or  discovery  proceedings  for 
the  purpose  of  obtaining  information  relating  to  the  above. 

18.  Disclosure:  Claims  Appeals 

In  claims  appeals  disclosure  of  privileged  data  or  information  to  other  than 
the  claimant  or  his  representative  must  be  limited  to  those  parties  involved 
in  the  appeals  process. 

19.  Disclosure:  PSRO  Deliberations 

PSRO  deliberations  concerning  patients,  practitioners  and  facilities  which 
serve  as  a  basis  of  PSRO  decisions  shall  not  be  disclosed  outside  the  PSRO. 
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20.  Disclosure:  Sanction  Proceedings 

Subject  to  regulations  governing  administrative  hearings  under  section 
205(b)  of  the  Social  Security  Act,  and  provisions  for  judicial  review, 
privileged  data  and  information  and  sanction  reports  may  be  disclosed  for 
purposes  of  sanction  proceedings,  but  disclosure  is  limited  to  physicians  or 
facilities  subject  to  sanction  or  their  representatives,  the  appropriate  State- 
wide Council  for  purposes  of  review  and  comment,  and  the  Secretary  or  his 
authorized  representatives  for  purposes  of  sanction  determinations. 

21.  Disclosure:  Results  of  Sanction  Proceedings 

If  sanctions  are  levied  on  health  care  practitioners  or  health  care  providers 
by  the  Secretary  pursuant  to  Section  1160  (b)(2),  the  name  of  the  sanctioned 
party,  the  action  taken  and  the  nature  of  the  sanction  must  be  made  a 
matter  of  public  record  by  both  the  Secretary  and  the  PSRO. 

22.  Disclosure:  Monitoring,  Review  and  Evaluation 

For  purposes  of  Federal  and  State  program  monitoring,  review,  and  evalu- 
ation, privileged  data  and  information  may  only  be  accessed  by  on-site  visits 
to  the  PSRO  or  the  other  components  of  the  PSRO  review  system  in  which 
the  privileged  data  and/or  information  is  stored.  Privileged  information  or 
data  may  not  be  physically  removed  and/or  transmitted  outside  of  the 
PSRO  review  system  except  for  the  purpose  of  appeals  or  sanctions.  Pursuant 
to  paragraph  #8  all  privileged  information  and  data  needed  for  monitoring 
and  program  review  purposes  must  contain  all  personal  identification  in  a 
coded  form. 

23.  Disclosure:  Health  Care  Facility  Information 

Non-privileged  data  and  information  acquired  and/or  generated  by  any 
PSRO,  its  agents  or  ancillary  components  supporting  PSRO  review  which 
is  uniquely  identifiable  to  a  given  health  care  facility  may  be  disclosed  upon 
request  and  payment  of  a  fee  to  cover  the  expense  of  copying  the  requested 
information.  However,  the  health  care  facility  must  be  notified  in  writing 
30  days  prior  to  disclosure  to  permit  the  facility  to  review  the  information 
for  accuracy  and  to  provide  comments  to  accompany  the  disclosed  informa- 
tion. 

24.  Disclosure:  Non-Privileged  Information 

Non-privileged  information  and  reports  generated  within  the  PSRO  may 
be  disclosed  to  individuals,  organizations  and  institutions  upon  request  and 
payment  of  a  fee  to  cover  the  expense  of  copying  the  requested  information. 
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The  following  statement  was  adopted  by  an  overwhelming 
majority  of  the  Board: 

A.  "Medical  records^   for  these  purposes,   are  any  materials 
relating  to  a  person's  physical  or  mental  health  prepared  for 
retention  in  permanent  form  in  the  possession  of  any  custodian 
of  medical  records. 

B.  "Any  person  may,  on  request,  have  access  to  and  the  right 
to  have  copies  of  his/her  own  medical  records  in  the  possession 
of  his/her  doctor,  a  hospital  or  any  other  custodian  of  medical 
records. 

C.  "Persons  other  than  the  patient  may  have  access  to  the 
patient's  medical  records  only:    (1)   if  the  patient  has  given 
voluntary  and  informed  consent  in  writing  to  the  person  seeking 
access  or  the  release  of  records  for  a  specific  use,  provided 
that  the  record  will  not  be  used  for  any  other  use?  or (2)  if 
the  person  claims  access  by  virtue  of  a  subpoena,  of  which  the 
patient  has  been  given  notice  and  the  usual  opportunity  to  con- 
test it  prior  to  it's  execution;   or   (3)   if  the  records  relate 

to  a  communicable  disease  that  a  health  department  or  other 
government  agency  is  recruired  by  law  to  identify  and  control, 
where  the  law  forbids  disclosure  of  this  information  for  any 
other  purpose  and  the  patient,  when  possible,   is  given  notice 
of  the  legal  requirements;  or   (4)   if  material  from  the  records 
is  to  be  used  in  connection  with  medical  or  scholarly  research, 
or  publication  of  a  case  history,  or  any  other  related  writing, 
in  which  event  the  identity  of  the  patient  must  be  disguised 
in  accordance  with  appropriate  professional  standards,  and  sub- 
ject to  professional  disciplinary  review." 
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SUMMARY  OF  ETHICAL  HEALTH  DATA  CENTERS  CONCEPT 


Brief  Summary  of  the 
Joint  Task  Group  on  Ethical  Health  Data  Centers 


The  Joint  Task  Group  was  appointed  in  1973,  by  the  President  of 
the  Medical  Society  of  the  County  of  Erie,  and  by  the  Chairman  of  the 
Committee  on  Data  Processing,  Medical  Society  of  the  State  of  New  York. 
The  purpose  was  to  form  a  multidisciplinary  team  to  explore  the  poten- 
tial utility  of  electronic  data  processing  and  related  scientific  disciplines, 
to  examine  the  potential  risks  attached  to  computerization  of  sensitive 
clinical  information. 

The  initial  Joint  Task  Group  included  physicians,  representatives 
of  the  regional  nursing  association  and  medical  record  association.  Soon 
after  the  first  meeting,  the  Health  Sciences  Faculty  of  the  State  University 
of  New  York  at  Buffalo  offered  support,  and  subsequently,  other  faculty 
members  of  the    University  joined  the  Task  Group,  providing  their 
special  expertise.    The  Task  Group  met  regularly,  every  week.  The 
various  members  had  special  background  in  ethics,  broad  competence  in 
philosophy,    law  and  jurisprudence,  computer  sciences,  information  re- 
trieval, sociology,  health  care  planning,  and  various  areas  related  to 
health  care.    The  Joint  Task  Group  also  invited  experts  from  operating 
data  systems  with  extensive  data  security  measures. 

The  Joint  Task  Group's  deliberations  were  summarized  in  their 
minutes,  a  100  page  document  available  to  those  interested  in  the  problem 
of  medical  confidentiality.     The  Joint  Task  Group  developed  the  following 
concepts  and  recommendations: 

(1)  information  processing  technology,  when  fully  developed,  will 
assist  clinical  medicine  in  decision  making,  it  will  close  the  gap  between 
existing  knowledge  and  bedside  medicine,  and  it  will  assist  the  patient 
by  maintaining  a  condensed,  timely,  pertinent  medical  history,  genetic 
and  social  history; 

(2)  computer-based  primary  medical  data  must  be  effectively 
protected  in  oider  to  maximize  the  benefits  and  to  minimize  the  risks; 
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(3)  for  adequate  protection  of  primary  medical  and  related  in- 
formation ethical  health  data  centers  should  be  created,  with  a  formal 
code  of  professional  conduct,  with  explicit  and  appropriate  operational 
standards,  with  clearly  defined  data  access  policies,  and  with  adequate 
data  security  measures  to  provide  medical  confidentiality; 

(4)  such  ethical  health  data  centers  should  be  the  only 
acceptable  way  for  handling  confidential  and  potentially  sensitive  primary 
clinical  data; 

(5)  the  professional  staff  operating  an    ethical  health  data  center 
shall  have  proven  competence  in  information  processing  sciences  and 
technology,  integrity  and  moral  obligation  to  provide  medical  privacy 

to  those  patients  who  have  agreed  to  have  their  health- related  data 
stored  and  processed; 

(6)  computer-based  data  handling  operations  which  currently 
process  potentially  sensitive  clinical  information  should  be  regulated  as 
to  data  collection,  access  and  information  release,  so  as  to  conform 
with  the  ethical  standards  of  practice  of  medicine; 

(7)  the  Medical  Society  of  the  State  of  New  York,  in  cooperation 
with  other  appropriate  organizations,  shall  create  an  agency  to  inspect, 
accredit  and  regularly  visit  ethical  health  data  centers  located  in  New 
York  State.    The  American  Medical  Association  should  make  all  the 
above  a  national  policy; 

(8)  educational  programs  shall  be  created,  without  delay,  for 
those  physicians,  nurses,  medical  record  administrators,  other  health 
related  professionals  and  information  scientists  who  intend  to  staff 
ethical  health  data  centers; 

(9)  effective  public  education  shall  be  initiated  to  explain  the 
value  of  confidentiality  of  medical  records,  to  make  the  public  aware 
of  the  emerging  threats  to  medical  privacy,  and  to  inform  the  public 
what  options  are  available  for  conserving  the  confidentiality  of  primary 
medical  information; 

(10)  a  legal  framework  shall  be  developed  to  protect  the  autonomy 
of  ethical  health  data  centers,  and  to  impose  punitive  measures  on  violation 
of  confidential,  privileged  medical  information. 


373 


GUIDELINES  ON  PRESERVING  CONFIDENTIALITY  OF  MEDICAL  RECORDS 
National  Association  of  Blue  Shield  Plans 
Approved:     September  5,  1975 


The  issue  of  confidentiality  of  medical  records  has  become  a  major  concern 
particularly  with  the  passage  of  the  Professional  Standards  Review  Organiza- 
tion law  and  impending  legislation  for  National  Health  Insurance.  Physicians, 
health  insurance  carriers,  government  officials  and  others  are  concerned 
about  the  potential  threat  of  indiscriminate  access  to,  and  releasing  of, 
sensitive  patient  data. 

From  its  inception,  Blue  Shield  has  functioned  as  a  responsible  third  party 
in  assuring  the  confidentiality  of  the  physician-patient  relationship.  Its 
use  of  medical  data  has  been  for  two  essential  purposes:    assuring  the  patient' 
right  to  proper  payment  of  medical  care  and  the  review  of  the  appropriateness 
and  necessity  of  care  rendered  by  physicians  and  other  health  care  providers. 

By  virtue  of  tlilb  Inclusion  Into  the  relnt  lonslilp ,  Blue  Shield  believes  it 
should  state  publicly  Its  policy  and  outline  Its  current  procedures  for  main- 
taining the  confidentiality  of  medical  data, 

BLUE  SHIELD  POSITION 

It  is  Blue  Shield's  position  that  the  confidentiality  of  medical  information 
It  accumulates  as  a  medical  prepayment  organization  must  be  assured.  The 
consequence  of  Improper  disclosure  of  medical  data  entrusted  to  a  Plan  can 
be  detrimental  to  the  patient,  the  physician  and  the  particular  Blue  Shield 
Plan. 

Each  Blue  Shield  Plan,  therefore,  has  a  legal  and  eth-'.cal  responsibility  to 
administer  effective  safeguards.     The  aim  of  these  safeguards  is  to  permit 
authorized  access  to  the  information  while  maintaining  the  integrity  of  the 
confidential  relationship  between  patient,  physician  and  Blue  Shield. 

GUIDELINES  OF  CONPIDENTIALITY 

Blue  Shield  Plana  have  always  administered  procedures  to  safeguard  medical 
information.     The  intent  of  the  following  guidelines  Is  to  suggest  a  review 
of  those  procedures  already  in  existence  or  to  implement  programs  which  may 
be  necessary  to  achieve  the  objective  of  assuring  the  confidentiality  of 
medical  Information. 


PUBLIC  ACCESS  AND  RELEASE  OF  DATA 

It  should  be  recognized  that  a  Blue  Shield  Plan  is  a  third  party  to  the 
pntlent-physiclan  relationship.     Since  Blue  Shield's  file  is  n  secondary  or 
duplicate  copy  of  the  physician's  primary  record,  tliere  should  be  no  need 
to  Inquire  into  Blue  Shield's  file.     Patient   inquiries,  therefore,  regarding 
medical  data  should  be  referred  to  the  physician.     However,  Blue  Shield  may 
nonetheless  become  involved  in  a  formal  request.     Therefore,  the  following 
guidelines  should  be  applied: 

1.     In  general,  medical  information  should  not  be  released  without  a  court 
order.    When  under  a  court  order  to  release  certain  medical  Information, 
the  Blue  Shield  Vlun  should  release  only  the  specific  information  re- 
quested.    Release  of  data  beyond  that  which  is  requested  is  a  violation 
of  the  confidentiality  of  the  data. 
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2.  Medical  information  should  never  be  released  over  the  telephone. 

Although  the  Plan  may  be  authorized  to  release  information,   it  must  not 
do  so  by  telephone.     The  Plan  has  no  proof  that  the  person  receiving 
the  data  is,  in  fact,  the  individual  authorized  to  receive  It. 

3.  Medical  information  may  be  released  in  the  aggregate  form,  however, 
requests  for  such  data  should  be  in  writing  and  should  Include  the  pur- 
pose for  which  the  data  will  be  used. 

It  is  frequently  necessary  to  release  medical  data  for  purposes  of 
research  for  the  study  of  utilization  trends.    The  data  must  not,  however, 
identify  patient,  subscriber  or  physician. 

Additionally,  the  Plan  must  know  who  is  requesting  the  information,  and 
to  the  best  of  its  ability,  assure  that  the  data  will  be  utilized  in  a 
proper  manner.     No  valid  determination  to  permit    or  refuse  release  can 
be  made  without  this  data. 

4.  Medical  information  may  also  be  released  to  the  extent  necessary  for 
appropriate  peer  review  bodies  to  assist  in  claims  determination  relative 
to  costs  and  quality  of  care. 

Tn  these  situations,  patient  identi f icntlon  should  be  deleted.  In 
addition,  physician  identification  should  also  be  deleted  unless  a  peer 
review  organization  deems  It  essential  to  the  review.    When  the  identity 
of  the  physician  is  essential,  the  physician  should  be  notified. 

ADMINISTRATIVE  RESPONSIBILITY 

1.  The  Chief  Executive  Officer  should  appoint  specific  officers  or  admini- 
strative employees  who  have  the  responsibility  of  authorizing  release 
of  medical  Information. 

This  assists  the  Plan  in  making  certain  that  release  of  information  hat 

been  properly  authorized  and  reduces  confusion  over  the  requirements  that 
must  be  met. 

2.  When  in  doubt,  the  Plan  should  rely  upon  its  legal  counsel  to  determine 
the  appropriateness  of  a  request  for  Information  and  the  extent  of  any 
release  of  medical  data. 

This  assures  the  Plan  that  questionable  requests  receive  the  necessary 
legal  considerations  and  that  any  release  of  information  has  met  the 
proper  legal  requirements. 

INTERNAL  ACCESS  AND  HANDLING  OF  MEDICAL  INFORMATION 

1.  Access  to  medical  information  should  be  limited  to  a  "need  to  know"  basis. 

Confidential  information  Implies  restriction  to  the  least  number  of 
people  necessary.     Indiscriminate  access  merely  compromises  those  proce- 
dures intended  to  safeguard  the  data. 

2.  Adequate  orientation  and  training  programs  should  be  developed  and  main- 
tained which  emphasize  the  sensitivity  of  medical  records  and  the  need 
to  maintain  thoJr  Integrity. 

The  orientation  and  training  program  on  the  need  to  preserve  confidential- 
ity should  be  given  high  priority  and  consist  of  both  oral  and  written 
presentations.     In  addition,  periodic  re-orientations  on  confidentiality 
of  medical  data  should  be  conducted.     If  safeguards  are  not  adequately  met, 
an  invasion  of  privacy  may  occur  involving  both  the  employee  and  the  Plan. 
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3.  Plan  employees  should  seek  only  those  data  necessary  to  adjudicate  a 
claim,  case  or  utilization  patterns  and  profiles. 

For  example,  if  the  Plan  needs  only  a  discharge  summary  or  consultation 
report,  it  should  not  ask  the  hospital  or  physician  for  the  entire  record. 
To  do  so,  not  only  creates  storage  problems,  but  also  places  unnecessary 
ljurdens  on  those  mechanisms  which  are  meant  to  Insure  confidentiality. 

4.  Adequate  security  precautions  should  be  Implemented  to  limit  access  to 
computers  and  data  banks  to  those  operating  the  systems. 

The  massive  amount  of  information  collected  by  a  Plan  requires  the  use 
of  automated  data  systems  to  perform  its  functions  in  an  efficient  and 
timely  manner.     This  consolidation  of  data  in  computer  storage  banks  or 
magnetic  tapes  facilitates  easy  access  to,  and  retrieval  of,  information 
by  anyone  capable  of  operating  the  systems  or  copying  tapes. 

5.  Employees  should  be  encouraged  to  handle  confidential  data  in  a  profes- 
sional manner. 

Confidential  information  should  not  be  discussed  except  for  the  purpose 
of  adjudicating  a  claim. 


In  addition  to  a  review  of  existing  safeguard  procedures.  Plans  are  encouraged 
to  communicate  their  activities  to  their  subscribers  and  physicians.     It  Is 
essential  that  their  understanding  and  cooperation  be  gained  in  order  that 
any  procedures  implemented  by  the  Plan  may  be  effectively  administered. 
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9 .  Policies  and  Recommendations  for  Policies,  American  Society  of  Internal  Medicine 


A.  Statement  on  Confidentiality  of  Medical  Records,  Approved  November,  1973 
Background 

Concerns  relating  to  the  confidentiality  of  medical  records  are  increasing  as 
the  involvement  of  third  parties  in  health  care  delivery  is  expanded.     These  concerns 
are  heightened  by  poorly  defined  authorizations  for  release  of  information  and  by  the 
increasing  capability  of  machines  for  communicating  interrelated  identifiable  patient 
information  without  the  patient's  knowledge  and  approval. 

Evaluation 

The  right  of  the  patient  to  confidentiality  of  his  medical  records  is  irrevocable. 
Third  parties  seeking  any  exception  should  be  charged  with  the  responsibility  of  fully 
informing  patients  of  the  possible  consequences  of  such  exceptions,  and  use  by  third 
parties  of  any  privileged  information  must  be  limited  to  the  purpose  for  which  it  was 
solicited. 

Current  laws  do  not  adequately  protect  a  patient's  rights.     The  American  Society 
of  Internal  Medicine  believes  that  there  is  an  immediate  need  for  legislation  which 
protects  personal  data  on  individual  citizens  and  groups  of  citizens.     We  believe 
that  there  is  a  potential  for  personal  injury  or  abuse  by  "authorized  users." 

Policy  Statement 

The  American  Society  of  Internal  Medicine  will  work  through  the  appropriate 
legislative  channels  and  appropriate  professional  organizations  for  a  law  which  will 
provide  due  process  guarantees.     These  guarantees  of  confidentiality  are  to  include 
security,  accuracy,  provision  for  change,  knowledge  of  purpose,  and  informed  permission 
for  use. 

B.  Data  Control  by  Government  Programs 
Background 

There  is  a  history  of  physician  difficulty  in  obtaining  data  aggregated  by 
government  programs. 

Evaluation 

The  government  is  increasingly  involved  in  information  gathering  and  there  seems 
to  be  a  natural  tendency  by  those  who  pay  for  data  to  exercise  total  ownership 
prohibiting  reasonable  and  necessary  access.     We  are  concerned  about  access  to  informa- 
tion generated  in  the  process  of  medical  care.     We  believe  that  access  to  data  from 
federal  programs  must  be  provided  in  order  that  the  data  itself  may  be  subjected  to 
scrutiny  regarding  necessity,  appropriateness  aucid  quality. 

Policy 

The  American  Society  of  Internal  Medicine  believes  that  the  right  of  access  to 
data  by  a  data  subject,  either  an  individual  or  an  organization,  is  irrevocable. 

C.  Excerpt  from  Proposed  Policy  for  ASIM  Contained  in  Report  on  Confidentiality, 
Conference  Committee  C,  from  Board  of  Trustees,  February,  1975^ 

Definitions 

IT!  The  primary  or  permanent  record  belongs  to  the  physician  and  his  patient. 
It  is  the  permanent  data  base  which  meets  peer  requirements  for  sufficiency  and  its 
release  should  not  occur  except  with  dual  consent  and  then  only  for  the  purpose  of 
treatment  or  patient  management.     The  single  exception  to  this  consent  requirement 
is  the  instance  of  legal  action  in  which  case  record  usage  requires  due  process 
guarantees.     The  Primary  Record  may  not  contain  notes  made  and  retained  by  the 
physician  solely  for  his  personal  use. 

2.  The  active  (working)  record  is  the  property  of  a  physician  and  is  solely  for 
his  personal  use  in  connection  with  the  diagnosis  or  treatment  of  a  patient  and  is 
privileged  unless  such  privileges  are  used  to  affect  the  patient's  rights,  benefits 
or  liabilities,  in  which  case  its  use  is  subject  to  due  process  requirements.  The 
active  record  may  contain  notes  which  the  physician  intended  solely  for  his  own  use. 

3.  Secondary  data  should  be  released  only  in  a  minimum  set  of  data  elements 
which  will  fulfill  a  "demonstrated  need,"  and  then  only  with  the  authorization  of  the 
data  subject(s). 
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4.  Certain  secondary  records  used  in  audit  or  peer  review  should  be  privileged 
and  prohibited  from  being  admitted  in  court  proceedings. 

Life  Span 

1.  The  life  span  of  an  adult's  permanent  record  should  be  no  less  than  five 
years  from  the  data  of  last  activity  (data  entry)  unless  surgery  has  been  performed. 
In  this  instance,  it  should  be  kept  for  at  least  ten  years  unless  the  patient  dies. 
The  record  should  be  maintained  for  a  period  of  (at  least)  two  years  after  death. 

2.  The  minor's  permanent  record  should  be  maintained  for  at  least  five  years 
after  reaching  adulthood.     If  surgery  has  been  performed  on  a  minor,  the  record 
should  be  preserved  for  a  minimum  of  ten  years  after  the  patient  becomes  an  adult 
under  state  law. 

5.  Primary  medical  records  for  mentally  incompetent  persons  should  be  maintained 
throughout  the  individual's  lifetime  without  regard  to  activity  since  statutory 
limitation  may  never  prohibit  suit  for  alleged  malpractice. 

4.  The  life  span  of  a  secondary  record  with  patient  identity  should  correspond 
exactly  to  the  period  required  to  accomplish  specific  objectives  for  which  it  was 
obtained. 
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10,  Members  of  the  ITBS/ACK  Workshop  on  Privacy,  February  8-9,  1973 


Chairman:  Alan  F.  Westin,  Professor  of  Public  Law  and 
Government,  Columbia  University,  New  York  City 

Stanley  J.  Aronoff,  State  Senator,  Ohio 

Melvin  F.  Bockelman,  Computer  Systems  Division,  Kansas  City,  Missouri 
Police  Department 

Walter  K.  Carlson,  Corporate  Consultant  on  Marketing,  IBM  Corporation 

Russell  L.  Fenwick,  Vice  President,  Bank  of  America,  San  Francisco 

John  L.  G-entile,  Deputy  Director,  Illinois  Department  of  Finance 

Lance  Hoffman,  Professor  of  Electrical  Engineering  &  Computer  Science, 
University  of  California,  Berkeley 

Seymour  Jeffrey,  Institute  for  Computer  Sciences  and  Technology, 
national  Bureau  of  Standards 

Michael  Kepplinger,  Office  of  Computer  Information,  National  Bureau  of  Standards 

Paul  F.  Krueger,  Deputy  Chief,  Statistical  Policy  Division, 
U.  S.  Office  of  Management  &  Budget 

Dr.  Peter  G.  Lykos,  Program  Director,  Special  Research  Resource, 
National  Science  Foundation 

David  B.  H.  Martin,  Executive  Director,  Committee  on  Automated  Personal 
Data  Systems,  Department  of  Health,  Education  and  Welfare 

Anthony  G.  Oettinger,  Professor  of  Applied  Mathematics,  Harvard  University 

James  E.  Riley,  Legal  Counsel,  UNIVAC,  Blue  Bell,  Pennsylvania 

Herbert  Saxon,  Manager,  Public  Safety  &  Civil  Systems  Department, 
System  Development  Corporation,  Santa  Monica,  California 

John  H.  F.  Shattuck,  American  Civil  Liberties  Union,  New  York  City- 
Rein  Turn,  Rand  Corporation,  Santa  Monica,  California 
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Persons  Attending  Draft  Report  Review  Conference,  September  16-17,  1975, 


Gaithersburg,  Maryland 


Chairman:  Dr.  Vernon  Wilson,  Vanderbilt  University,  Nashville,  Tennessee 
Robert  R.  Belair,  Domestic  Council  Committee  on  the  Right  of  Privacy 
Colonel  Rudolph  G.  Bickel,  M.D. ,  U.  S.  Air  Force 

Mary  Converse,  Bureau  of  Professional  Services,  American  Hospital  Association 

Robert  H.  Courtney,  Manager,  Data  Security  and  Privacy,  IBM  Corporation 

Royal  Crystal,  Bureau  of  Quality  Assurance,  Department  of  Health,  Education, 
and  Welfare 

Hope  Eastman,  Associate  Director,  Washington  Office,  American  Civil  Liberties 
Union 

John  P.  Fanning,  Special  Assistant  to  the  Director,  Office  of  Policy  Development 
&  Planning,  Office  of  the  Assistant  Secretary  for  Health 

Maurice  Grossman,  M.D. ,  Clinical  Professor  of  Psychiatry,  Stanford  University 

Daniel  K.  Harris,  American  Medical  Association 

Carnault  Jackson,  M.D.,  San  Antonio,  Texas 

David  B.  H.  Martin,  Administrative  Conference  of  the  United  States 

Peter  F.  McCloskey,  President,  Computer  and  Business  Equipment  Manufacturers 
Association 

Dr.  Robert  H.  Mugge ,  National  Health  Center  for  Health  Statistics  Public  Health 
Service,  U.  S.  Department  of  Health,  Education  and  Welfare 

Carole  Parsons,  Executive  Director,  Privacy  Protection  Study  Commission 

Elaine  0.  Patrikas,  Chair,  Department  of  Health  Records  Administration,  College 
of  Allied  Health  Professions,  Temple  University 

Elizabeth  Price,  Director,  Professional  Services,  American  Medical  Records 
Association 

Jack  Richardson,  IBM  Corporation 

Quincy  Rodgers,  Executive  Director,  Domestic  Council  Committee  on  the  Right 
to  Privacy 

Walter  Rubenstein,  Social  Security  Administration 

Vergil  N.  Slee ,  M.D. ,  President,  Commission  on  Professional  and  Hospital 
Activities 

Joseph  Terdiman,  Kaiser  Hospital,  Oakland,  California 
Willis  Ware,  Rand  Corporation,  Santa  Monica,  California 

Lawrence  L.  Weed,  M.D. ,  Director,  PROMIS  Laboratory,  University  of  Vermont, 
Burlington,  Vermont 

From  the  Medical  Records  Project  Staff: 

Alan  P.  Westin 
Michael  A.  Baker 
Helene  Toiv 

Prom  the  National  Bureau  of  Standards: 

Ruth  M.  Davis 
Seymour  Jeffrey 
Michael  Kepplinger 
John  L.  Berg 
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